Extracted

• • Target

    7c945b70315e7b1dfa807549c90712e0792380a418c13d56dbd853e4ddddecc7

  • Size

    13.8MB

  • MD5

    d5e0c1a6916a3424abec42a62e9af859

  • SHA1

    1828fb74c0e0f54dad6e06df6926c8eb58c3a203

  • SHA256

    7c945b70315e7b1dfa807549c90712e0792380a418c13d56dbd853e4ddddecc7

  • SHA512

    fc045d983c40c7056404416d4dd8241c86e1ec1c05e802b17212f93f3cc602d63099316e4ab78a96e4e5fadac64042b3c281871ce2cb1cca1e28f8e5763486d6

  • SSDEEP

    393216:Ugan8IDOJCnwCpvC3VyiaRiGRObwZngWv:HHxJuwCk3VfkiGwbMvv

  Score

  10^/10

  toxiceyerattrojanupxasyncrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2