Extracted

• • Target

    INV#001.exe

  • Size

    300.0MB

  • MD5

    79a721193aea183da48ebce3f397bcef

  • SHA1

    3315518cf5be28cc5d6399f984308d9b276089cc

  • SHA256

    5448955815779876e98583d1accbd0cb8a6f525906c05d7bd828114cdf870193

  • SHA512

    21f688290c108da832a1480175958f55f22fa03efa212423fd33f0e389e82071ab6a3d046528c210babc83b400cf17fd90d9244abafbc496bc321d66d0b9804c

  • SSDEEP

    6291456:SN889w7Nc2HK90Lxg4xMszaG3E0sR2eUAdBGU+yy/JsQA/qC:SN889Bg00Lu4xMgaGUxRZpdBGayR/oq

  Score

  10^/10

  persistenceasyncratvenom clientsrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2