Extracted

• • Target

    Statment#924869506.iso

  • Size

    1.4MB

  • MD5

    4b0aa2a63703f774aa8687300200a04d

  • SHA1

    af1118e88a4aad29bbc8760ed2f1b7a7a5017042

  • SHA256

    8dda70b17eda9096c62343eec5f60a3ed132f66a6f3d2e58c39afbad7280e9bc

  • SHA512

    ab280a85edbec30283be854fc1ebce7936561ffc00d0108411f65e4b6508c586875448db31c78686275c9aeae2aba5649ff6acafc73047608ebc269190e84bdc

  • SSDEEP

    384:6BP01dUB7P1dUB7OpnIUAkgko0oUQEwEo0i5UAEgEo0oUwkQko0IUAkgko0oUQEu:6d01dE7P1dE7OpCAtVAi

  Score

  10^/10

  asyncratelsa3eedexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1