Extracted

• • Target

    83a1b442bf9761f33881468eb8be300e18c5c12691eb52681efee2c4c5842a06.chm

  • Size

    190KB

  • MD5

    9d9a0a119044c6a83d533a1941bb64c5

  • SHA1

    279387ccf49c5f71c99f8b89b333be4a70f6cab6

  • SHA256

    83a1b442bf9761f33881468eb8be300e18c5c12691eb52681efee2c4c5842a06

  • SHA512

    31c4edbcff416df4cada81dbd1e3bdc752cb8a74c837787feba01d9e93e00970b15efac6bf70548b8ba1811cf7e7522bbd64cfe0572d5619759b8069b5b399b2

  • SSDEEP

    3072:Xg4C8YLEo5xuIvDocDWjc/pgDXQgKpacezvRBDobwrArHMp1G6/AirUIKX6MA:XpYIW0UY8pTxp/mjmqArYRQIKX5A

  Score

  10^/10

  asyncrat2023rat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2