Extracted

• • Target

    17f89183d951f5ea258d8d242368a3d8.exe

  • Size

    612KB

  • MD5

    17f89183d951f5ea258d8d242368a3d8

  • SHA1

    41d7143f06a9fe53b6d8fda2b6d7c629c7a7a133

  • SHA256

    e54c38c8d43f2a11ac1c997438d4586a3270f1545f8ef02b8992ebc35005823c

  • SHA512

    65e59efd1e77def251c8def6065b7eb1c8944c0ec3c29f0b59eac3c7aa3dd1ced8b4ac5993804736a6b724528ce36fbd6aaf6c05c86e594eb7a61de644f0d71d

  • SSDEEP

    12288:NcrNS33L10QdrXjZDnDLRH6/cOOScBEcmJE28syNM34odu+K:wNA3R5drX1DDLRHMncBeFySIodrK

  Score

  10^/10

  asyncratdefault8rat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2