Extracted

• • Target

    usermode.exe

  • Size

    571KB

  • MD5

    6ff532b8468ad647aea71708cdf259ff

  • SHA1

    8bf56f629e2c32153ba5037bf981dec868f41ce8

  • SHA256

    7cbd57fe2ffbaa6da63c865cce81eaf33c083e0b23d69cde51ada9f91f309a99

  • SHA512

    4c828064856d29a6530a7b633f4772190ef5d5dd92909ae78610c9319ac9d0f5388e8a15515a824109576d31522d89e06ed88dd1f8e52a8ea058c6e345ea852b

  • SSDEEP

    12288:rWYUNQEMuGIbS2McEqE1CMSD9Opbd0xEY8Q3:pUNiufScEf0H9OpqxL

  Score

  10^/10

  asyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2