Extracted

• • Target

    msedge.exe

  • Size

    145KB

  • MD5

    6a4ecf73deebde28f382fcfb5bec6217

  • SHA1

    dd0e386f238500e74d131bda5c206509d5d07687

  • SHA256

    cbf37235e35f3823287ffa5adead151873944b9d540ad4c953d29c4f8711d1fd

  • SHA512

    859e185da74e2f300cc3d7e215c2cc8e3ed56db39a0de28f9589e8743fa8730377ed06d239ea18c10345f7d243b34c5f0f0a468692b2b3f9691a092aa6d38834

  • SSDEEP

    3072:+UOcxHCoeGPMVhYSnu1bhnQIe5BV0WUniyimyJLY:+EeGPMVKiwb9re5v0WURyt

  Score

  10^/10

  asyncratdefaultdiscoveryratpersistence

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3