Extracted

• • Target

    Confirmation.exe

  • Size

    1.3MB

  • MD5

    52ffadcc31852e900c70f28498187bc6

  • SHA1

    a6ef0d114f2a25c01eafb7a611f8821bfdc0e8af

  • SHA256

    5c06318e1614eed017bf727ddaf46ee6cb90a2115199b35e408bea8152298e1e

  • SHA512

    60028a5dba40a381554469d02fd56d2612d3a1f8250e1fca89c74ce7cab44127c5003845468ab044988cfcdb60dc3b590b2fb90c75f28576f6a407beb49c1787

  • SSDEEP

    24576:wNA3R5drXhDFw71enfWt03TzmNJ4Yx8eQ+aFvWoTzPslCsmUKedewxFJ5:p5VmefWts+NByeQJ9WoTzPPsmUVnXJ5

  Score

  10^/10

  asyncratdxgrouprat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2