Extracted

• • Target

    aitstatic.exe

  • Size

    91KB

  • MD5

    e6c995a0e7501ec3225445715167d8dc

  • SHA1

    79b02d623f87d34eb1c2377951f7175aca20d13b

  • SHA256

    411fff49f678ead45849d655d50084f667bef58a12f298b86697f2cf0fedbef6

  • SHA512

    617aac88b90264f0f8b3f5659f9c987291bd872f84289eec2d1e727275d54e973c4cee8f3e7b3c5089eeff620db7c728e061ef58f31606ecddffd81d37936868

  • SSDEEP

    1536:hM5PfX2tIAHgjWwKVF+DF9J4IstZsEaLBosLNkkFD74ptKq6:hM1fm/gjWw8+DTJ4IstgL6uNkkFD74pe

  Score

  10^/10

  asyncrattdiscoverypersistenceprivilege_escalationrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1