Extracted

• • Target
    AgentSetup.exe
  • Size 213.4MB
  • SHA256 72ec6f81b0de47f93bb8941bd86a10377a0bd6e5f188120679396ede0886a4b3
  • MD5 f9dbbde616f4fe8711cbc1a3fa120deb
  • SHA1 39d5cb442442002ee31ed827ca573f0dd35f704e
  • SHA512 481eaee2cfbbf8cae9b3894c8e964de66bd6c22c8e8c907c66c1e15e29665f55bcecab524c060ef364f21cfb13c360f9d0b1c72c2d955a08292cf1026b365d0c
  • SSDEEP 3145728:k6o6gaBwQG+sqLnCsSgPCFT9wSeoqOCJT/LcMP4ld6nO7uro6ymPNWeAwdloFLeS:Mv+sqTCsv2eSyp/LcI4KnTsPmPIwdVxQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratdefaultpersistenceratevasiontrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $TEMP/AgentSetup.exe
  • Size 215.8MB
  • SHA256 84372730101078190450b74595424f2cee64e2563ce8f024fce69e9206ba42e4
  • MD5 6f669ab8685bc09de164bdbdd4f378f1
  • SHA1 89bccf94119ff5e82e0cbfc22846367b897bb2a9
  • SHA512 cc7386cd2e4830ea293e4ef133790ba50ea68318b091ad04bf4cd8d2f84591c21e7e5a7cca4c1560fa84dbadb37c2540cdb36e2ba71ba073e755f3a17316e4a7
  • SSDEEP 6291456:OgWtYiMKyaDkSyq1R4YWeKejXQHUX2MP4Xs:TYY9GkSyWPfjgW2MQ8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral3behavioral4
• • Target
    $TEMP/WindowsUpdates.exe
  • Size 487KB
  • SHA256 8d2f5e538fecbbc4e1b210e46a3ff23e83d3e5d41889620a152d64e5837664f9
  • MD5 6ff93fe40aac2479a62a5e6a32f96aeb
  • SHA1 d5bdaca9eac46965b306aba3362fa81c60082d20
  • SHA512 151c5ddedd0df4866ebac29a75bcd88e50acf50e0087c63455ce6a1a0a706870b74a6e2c86cebf3c4221d800e2715b8fb872d71d884eabddef8e8b8b12e48d79
  • SSDEEP 12288:zy4elxMgArBBFxw90ZGAfYXQI7nlgMhZY5apWsjZtRupwNz:zy4eMXBsyvfYXQI7tJ7Rv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratdefaultevasionpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral5behavioral6