Extracted

• • Target

    P.O.exe

  • Size

    480KB

  • MD5

    2eff738980e22cf3f48b9cf8b78663ac

  • SHA1

    419d1ae415f048372bc9fbb99f7a050f0f7f88e5

  • SHA256

    832506397be8817683e8dcac4604eaee19f0add472b9332cb667067562487896

  • SHA512

    7d4973802a0615d6f64a1941f38f6d12d01b49315b07ddbc157261b32572745ae4bc07a9ff3d780596ed1f6bc9c873ffef20e8842d572dadbaea5e6d68964e3f

  • SSDEEP

    12288:j50R0MugiOXNbIxUTcKtt904GBfo3Jqlpjg:jyOMugiOCxUAitQu3Jqb

  Score

  10^/10

  asyncratrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2