Extracted

• • Target

    https://cdn.discordapp.com/attachments/1266100518472781897/1266497098614964396/Rinkooooooooooo.zip?ex=66a55cd6&is=66a40b56&hm=25783da6b1221bde2601b66b429874593422307e5e0e85f8a74b27c7c31bd343&

  Score

  10^/10

  asyncratdefaultdiscoverypersistenceprivilege_escalationrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1