Extracted

• • Target

    433db8ca4379cc5873903c7022b907ba15d8b92e42074455ab9de094a1d56ddc

  • Size

    2.4MB

  • MD5

    23878e53dc083c8a3eaaa56a47df0f46

  • SHA1

    33de428e36e9cbcbf1363587ce387a685c9aff9f

  • SHA256

    433db8ca4379cc5873903c7022b907ba15d8b92e42074455ab9de094a1d56ddc

  • SHA512

    3ea1a4534294567a63320ae71f4dddb4a5d9cab36ea74d5fd45f6514905e0b9de38dc46ca87138a17cc43b730662828f9f6101993697c6ec9a6574cf9b72b0d9

  • SSDEEP

    49152:C02faKRvNBmM9KzFa1F5y0ElNhIyGuDOfg2fwPB/XUSquJ3F:C0MFvfmM8zYF5y0ErqyhO42A/XUSq0F

  Score

  10^/10

  asyncratdefaultexecutionpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2