Extracted

• • Target

    view

  • Size

    84KB

  • MD5

    a9f8941616a5447c1e6b05d48789bc9c

  • SHA1

    39ba4832085d5cf1ab22ba03e2056027545f2235

  • SHA256

    16218dfb99864ae75f35ca58118a20cbc83562431af7eddfb925f11ef26164fa

  • SHA512

    c08536b90bdcbfe93a22a6afdde99f975f2ee2cb06e69994cf3e969e7c77b37cc979aec39f4d4098981bee333b781ee3760c557a962ff5b576f2442591f41084

  • SSDEEP

    768:vh/lZmmHYnApdwLQc7TCfpa0E3sSTrlh1JAAvQ7D13dNQL3YZowoKNEI56dPRLwb:mvCc1JtQ7RtNk309K+b7wCxdudWh+1yF

  Score

  10^/10

  asyncratdefaultmicrosoftpersistencephishingrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Drops file in Drivers directory

  • Sets service image path in registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft

  • Suspicious use of SetThreadContext

  behavioral1