Extracted

• • Target

    Infected.exe

  • Size

    63KB

  • MD5

    4ab63aeb8e93aa7784281b8692d25ff3

  • SHA1

    877e3e2f4729438ffdf7bfae3c7c261111e9dc6a

  • SHA256

    1b4ca2ea6683fa110a3409227361b8c29e00aa656ff197291b06105b36ec2fee

  • SHA512

    3623a467a97627b9d43660e2cfc9ed0334e1544a4bc68f9f1cb9cdfe8f365728fbaf9a5eec85e257c8d767aa4ac058b7a0e2eb0e1177514cd8a53d67be008885

  • SSDEEP

    768:Cuw6LVcsTPq781wC8A+XjuazcBRL5JTk1+T4KSBGHmDbD/ph0oXk5hSuEdpqKYhg:LeQPckdSJYUbdh9k54uEdpqKmY7

  Score

  10^/10

  asyncratdefaultransomwarerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Renames multiple (1273) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1