Extracted

• • Target

    B7F0467EA05CDB14EEA0F67FD09E8BC6.exe

  • Size

    78KB

  • MD5

    b7f0467ea05cdb14eea0f67fd09e8bc6

  • SHA1

    231ee0739e614251bc3d648885c77f6f8d0cbd58

  • SHA256

    111aa30a320d763f875d21e66345c86e8580ccbe0d50e99733991caff1d2201b

  • SHA512

    21fb8ab40f31987ebf977983012035d29034471c0f84779a636857e9a52110856155bc6ead9ac2e34dc29cbdee82c98941e4eafa4c7f73dac01b65b76c26ac97

  • SSDEEP

    1536:d6zKpOqlUTuWJR5UpJN6almL4REvOWTt0BO5FHBas9hhQ0YH:0zOOqeSQLUpJNflJEWWp0Q5z59hm7H

  Score

  10^/10

  discoveryexecutionupxasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2