Extracted

Extracted

• • Target

    c7bd91207ac565f362c9a9702bcf5cb278b414e8a5489087431a448011d32f47.exe

  • Size

    75.8MB

  • MD5

    864fec7c56d3a3fd0de982a049dc247a

  • SHA1

    ef6240916847124235a523bf867c91a944e1c65b

  • SHA256

    c7bd91207ac565f362c9a9702bcf5cb278b414e8a5489087431a448011d32f47

  • SHA512

    452acfeda622d2948cdab3820fe2e688f91b7a11da5d97e34f04e5c350d60aff069d5620a9961cd92876291a65511a83a6ab05619d5c3e8aa0280d3cd374335b

  • SSDEEP

    1572864:tERVE3V33f9SIdRMYxBvc+bOv6UEiQ/0SWyI+jHC7BX:tEgllfxBvTUOjddON

  Score

  10^/10

  asyncratxwormdefaultpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2