Extracted

• • Target

    31d44e6d5f1df017ec8d890e85ee50d3fc3165f802c7f4c68be7e4d61b36b51f.exe

  • Size

    947KB

  • MD5

    a573f4115e789e76360f3cbbc99846d7

  • SHA1

    7214cbe099b7d43bda779eec05bb4826f36c16de

  • SHA256

    31d44e6d5f1df017ec8d890e85ee50d3fc3165f802c7f4c68be7e4d61b36b51f

  • SHA512

    a62c61e8d76b8138a23003955f18d61b43e256827bcc93d6c84b51f5bcca3714def666810250388536f027fabef49cc30d22d06eab253713c74e4fe8950cee83

  • SSDEEP

    24576:YwaPp4ar0B90K7rji9f2N38rn+IJ9uoI9H4Wx9K+oJfFMYoMfY6:om90ii9bn+IJ9uoI9H4WK+oJ7w6

  Score

  10^/10

  asyncrat15 mayopersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2