Extracted

• • Target

    OTPBOT.exe

  • Size

    16.7MB

  • MD5

    d76d4061a38546dda1d9748588b75f18

  • SHA1

    adbcd8ada656dddd3809bdd8061f59fbb53351bd

  • SHA256

    7c833f195a6be1c64c85cca8f227f0226726609bc564f9577ef81924aa99c1b4

  • SHA512

    f4cdfe95be590c55fd32fcaf711961ab67fcee8dcceeb44bf8cb4e6e2208b207073ba7a329a843ac1d63d5f5a2d8fae78dc2043afc4b2829757246c05eff7fb1

  • SSDEEP

    393216:Ib7D+eNMC7Z61Kqm/1MpfnZ0ZjupISFOxcyUVBWABkgr0:U/mCNoZm9ML05ualxc0E

  Score

  10^/10

  asyncratdefaultexecutionmacropersistencepyinstallerrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2