Extracted

• • Target

    3dfx.exe

  • Size

    47KB

  • MD5

    4d7424a4bba97692e59b3b203066860f

  • SHA1

    08013fe3706ef2df075757640e99d0e697f820ba

  • SHA256

    e8cfa912e022bed8fcf57d3a03a3f5a1780b5cd547b7c190029d7b082632215a

  • SHA512

    99c90b108fbebb076e52fcfae84a489c4870e2978966bc89b485aced26f71c9c1cb3a99356531b2229c79449bfab94dbc53fc7553db5003d58c5ea0cc57ce242

  • SSDEEP

    768:2ugPNTjgkH7F7WUHw9pmo2q79UEOFY+ZlPI4yOlSTmP0bVpFn8O1U6VaegmSvbni:2ugPNTcI42dEQYD4yO8TmMbVpJ8V6Vam

  Score

  10^/10

  asyncratdefaultmicrosoftdiscoverypersistencephishingrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Registers COM server for autorun

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft
  behavioral1