Extracted

• • Target

    bb54c9a7ad63b674a1afe299d70c0ac67e399d1b055fee7bda03645ee2ae338e

  • Size

    5KB

  • MD5

    eff62daebe6a245573c619e4beef2a3a

  • SHA1

    e4de9e23b124e8289f2942b4a5ed6f304330d8cc

  • SHA256

    bb54c9a7ad63b674a1afe299d70c0ac67e399d1b055fee7bda03645ee2ae338e

  • SHA512

    ba9d1d2af417c954ff807e0c30737427d6c7779fbbd35454639aa0526b6e555f4b6e8b0c2d46c76c4a24e092b553f4621794788dccedf3a699d0a437afae43e9

  • SSDEEP

    96:QsTr79hCL1bhycGdH8uaRXtyuvk+1OAYysds9vk+1TbGvvqd3ojOxHrl:Q+X9hCL1bhyc33vksYylvkUb+qdth

  Score

  10^/10

  asyncratuwuiscomicpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1