Extracted

• • Target

    Pago.xls

  • Size

    146KB

  • MD5

    cb7929cf1abc35c3360f0c675995a551

  • SHA1

    fb773340fe210e3693b4b339696d9b849d4ed4e6

  • SHA256

    f8569a28afa079072bf1faf79e715dda7513e382dc423fc5ee07ec2f54223d24

  • SHA512

    97ee3275dd4362af1ed6f9c627b0dceb0ad65ece0f4d58c8c81a5addc8002def83977f411e4d7fbc7a033928c4a237d256aba7e7c3bec54a13232953e76a5ff2

  • SSDEEP

    3072:FnxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAki2PFXSQZb86A4ADAHdVUJgOmCM1y4K:VxEtjPOtioVjDGUU1qfDlavx+W2QnAkG

  Score

  10^/10

  asyncratfnockrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2