Extracted

• • Target

    NEAS.00699e7d571857ff1e94e07352cf6c60_JC.exe

  • Size

    1.3MB

  • MD5

    00699e7d571857ff1e94e07352cf6c60

  • SHA1

    9be668c2ea96a6549b23af2f6d43865b90725a0a

  • SHA256

    d1d0c38ef8df250fffe727e3780bf58e7c3488d23ceab02e5d90e2019981da81

  • SHA512

    7290983bc8956eb91529f0d75ef5ed37955f05603a1c1fd87c17fc5474966daf17c6cce8e80f0ba1c58651edd52cc235c50e9cdff2069a0f187e5f0bd4e20825

  • SSDEEP

    24576:xxBPi0Fos9qUzo5ZxwJcuYMJQMxD0jLfEAEx9pnFVBPlLCTYpI:bBPi0Fos9/MXmcuYuxD03TExbFv0Yp

  Score

  10^/10

  asyncratsapphireghostpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2