Extracted

• • Target

    1c0a8ab60132cd737b83b2c9b502dfb2d5e3cf14174cc84e422ca1d19277202b.exe

  • Size

    649KB

  • MD5

    e57213cd46e7e86a091b28a16a75ff63

  • SHA1

    530fc3194363f8aa63559a88f896aad76fdf2eda

  • SHA256

    1c0a8ab60132cd737b83b2c9b502dfb2d5e3cf14174cc84e422ca1d19277202b

  • SHA512

    285bea0686ee38221907a42bb97e3c4ab3eaf9a7b1e6ac4e352e1e1de6232e79a3662705c65e895a7a0779fc4c1d1477d90d94fe0e12cb7963737f6d2c644d05

  • SSDEEP

    12288:NcrNS33L10QdrXjcDnFGUlwKjykzxvsULnXhzl4uZBKhmjleQKetoaLm/:wNA3R5drXoDFH9jdFz7xzCwKWlBtoaL4

  Score

  10^/10

  asyncratmnockrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2