Extracted

• • Target

    WaveInstaller.exe

  • Size

    249KB

  • MD5

    b8a6cc953ead13dabfef6854bfe65139

  • SHA1

    51aaa0723d5d22c74c15f625e12662bf4aa2cfb7

  • SHA256

    4f9494cf61c3c10656a3f8eed5798ab604c815c34472c42c18b49656fb71d73e

  • SHA512

    9e7078acb76dd33b0811990b03b7e576eaedb75f13ba38f7c6457956d8c211231e86b02a6280e8dfa858b175003061867b0938e96efc7f9a2627d023983b3257

  • SSDEEP

    3072:G1NvtzbxNdSuLAsNeDF5nI0PGIj9lua/Obw0hFv2PCWpIdNrY:GTFzbPdt0sNOBTunbw0/5Wpi

  Score

  10^/10

  asyncratdefaultransomwareratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Renames multiple (6066) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2