Extracted

• • Target

    sample

  • Size

    510KB

  • MD5

    2b19d65705eee546214513fb65948b2a

  • SHA1

    20b6c01b9f20047fc9f3bf9baa14b5046cbc0012

  • SHA256

    106dc2ab6da5448b983e66c7c6850533006abf9176eb6ee3d58e101b83d8d47f

  • SHA512

    183bb9331b20d2f4118820bd372e5202220e29cfea2d5ae5fedd8d1a9bfaf548a9399aa604950553948899a1d75658e64480c660ce7f83bb89cd566e1385eb72

  • SSDEEP

    6144:+ldk1cWQRNTB2/Me7eC9g1HGnKBvYfew0PjZmwvhhlJdZBuUwXtgZcJeJ:+cv0NTg/XrRnKBwfOM0dayZKeJ

  Score

  10^/10

  discoveryexecutionasyncratdefaultpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2