Extracted

• • Target

    58d9e7016bb1ceef2c36ede58202d170

  • Size

    491KB

  • MD5

    58d9e7016bb1ceef2c36ede58202d170

  • SHA1

    95c9defb36b6ba08c78ad6068a2766dad1e33512

  • SHA256

    58a07549993c34caf8617e6cb341b44ceca162106b501fee09629936bad7bb51

  • SHA512

    aa688b35cd42d915d4503b1078535dc14bcfcbe7d30b8874dbc173cfc662685cc07a5d256b8452c1d113fdcebe77e074f60fb2d789d664ff401a94444a162e95

  • SSDEEP

    12288:vLDAIDCETPv7rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrUrrrrrrrrrrrrrrrf:YIDCETPzrrrrrrrrrrrrrrrrrrrrrrrg

  Score

  10^/10

  asyncratdefaultpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2