Extracted

• • Target

    Infected1.exe

  • Size

    14.0MB

  • MD5

    6e8f03f7fe2e82665e55c2626ea06ef1

  • SHA1

    35f635cafedaa480d8f606153003bdb016914cbc

  • SHA256

    29ced2fe633060e11ec10a236f8085a34cb8448ea7054cf6e8667ce7f7b4897f

  • SHA512

    366285e599e445ea3b11645708f047bebd5e8f51a4ea5767d93d5353e976161ac3c5da3a555d50606df395b6e195a3ca331e543aab1c1ed16287728a9ef8cf63

  • SSDEEP

    393216:jc6lGw0Y6m3aj2Kpj1caTF6n7mhbbmiyrEDxC:wtuFK6Kpjun7mBldC

  Score

  10^/10

  executionasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2