Extracted

• • Target

    4a2b9301dd513a94550497fe1648281454d71943f7c520627653d46c5cbfd542

  • Size

    356KB

  • MD5

    a5a3b104f9766a8ee15448451637ca86

  • SHA1

    d4880e65fba41b45fe248257d272c789fbf68a8b

  • SHA256

    4a2b9301dd513a94550497fe1648281454d71943f7c520627653d46c5cbfd542

  • SHA512

    5bbe437169bb5c3683a0a5851e0e01ea43d79527033a8aa50c4eb89a3870babb1fa5ed0cc5c213ebcf6aa7bc0c97254964f0187b344dc7d8507bc514ac39231b

  • SSDEEP

    6144:UsLqdufVUNDazuiX+lO3bKiYRlduXu4XiUwlhZHVmkY:PFUNDazCOMYXiykY

  Score

  10^/10

  asyncratdefaultevasionpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2