Extracted

• • Target
    Dropper.exe
  • Size 12KB
  • SHA256 b390f949531dac7a42bee35fc98e1b9890361b2be5fa3efcc8cae8263174244f
  • MD5 b11d9f89c1129428957175b7c55e8637
  • SHA1 6a1530364e3bf3c13a6500bdd313e1d8d4294301
  • SHA512 e368f3db1c511c6cfbb95f04c98e9df7fcda718f3f9c56dd34f5e9595eda9d072dc4af351a7ea7a2cea6f65117f7e2dd98fc97d6d6631673fdcdf939abe963ba
  • SSDEEP 384:fHPFcbjfi27q9bJnz6PbQGw+pfolwmfhhDj4VCsL:3yfiD9bJMbKwkhhD0wsL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratdefaultdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2