Extracted

• • Target

    74e8b8df8bf176cfdae5381336e466b0af5149ad92b877b95ddbb5f5d911e83d

  • Size

    1.8MB

  • MD5

    5e189818e7a91f70ab650334d2fa9185

  • SHA1

    625448d0cb20fec36503e01da474ec80b7f4b39a

  • SHA256

    74e8b8df8bf176cfdae5381336e466b0af5149ad92b877b95ddbb5f5d911e83d

  • SHA512

    e7ec4455753e7453c39e3839a8d958b23a1c823666447bcd472c5ce481288b01a450e6edf8b259d70b28adec0bc773203170024ce65984642e9515d102d2f038

  • SSDEEP

    49152:8I3YCPorTf5p7Fx1qd3m+JiGeatgs+kL1R:8SPO5p7YN1J9tgs31R

  Score

  10^/10

  asyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2