Extracted

• • Target

    819d812044fccc25692d6f0919850536d3486bdfdf296bea08ea3291fe1d425c

  • Size

    1.8MB

  • MD5

    1237a749cdfe8065f70beb76026fbf58

  • SHA1

    9e9febe7441cfaa52135c32ef1827af10bdc81bf

  • SHA256

    819d812044fccc25692d6f0919850536d3486bdfdf296bea08ea3291fe1d425c

  • SHA512

    57217329975517c09c32c49be0da9c694a7492347c13024eef77203ee16d3caaba8e77235a991194bcab961071d7ff887a1e5501eafc234f52ee4f840d3e6166

  • SSDEEP

    49152:zGXOVDKuXtwIarveK9plB91K70myaigDmXI:ieVDx6IaaK9plBXO03xgDmXI

  Score

  10^/10

  asyncratpurecryptersmokeloader787878 --- tpb --- 787878backdoordownloaderloaderpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Detect PureCrypter injector

    loader

  • Detects Smokeloader packer

  • Modifies WinLogon for persistence

    persistence

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2