Extracted

• • Target

    0e3be9658e97e3ea844e0d818a0f4731573ec5affe4f42e8d244e0c91717df68

  • Size

    501KB

  • MD5

    8b662719e44ab11419fe3e1d7e96cc03

  • SHA1

    af6c092ff304cd5131cc0295fa8b51a572af5388

  • SHA256

    0e3be9658e97e3ea844e0d818a0f4731573ec5affe4f42e8d244e0c91717df68

  • SHA512

    3a441802fad9b3eafe327d6239cb8891551df04ccf555658d8855fbbcdacda3abefc9e627b3a59cf28de9681e348d2cc749cd63514721c9b86e0519ceb57309a

  • SSDEEP

    12288:iSrH22qla5w/yXbxixFcRMFQIkeNCSo9mbX:iSrH0MW/IbxiYCQIkeNCSB

  Score

  10^/10

  asyncratpurecrypterdownloaderexecutionloaderpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect PureCrypter injector

    loader

  • Modifies WinLogon for persistence

    persistence

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2