Extracted

Extracted

Extracted

• • Target

    734a651df8e337d0ce287b737eda1ba09e11b3ac00b7aa00c0b4ff66b67a8f40

  • Size

    4.1MB

  • MD5

    c1d4a5533effd830b2511e3d36126dbf

  • SHA1

    d67fdc24d7602e6c8b1a5bdbb46fe1bfeee8ec25

  • SHA256

    734a651df8e337d0ce287b737eda1ba09e11b3ac00b7aa00c0b4ff66b67a8f40

  • SHA512

    1495e65c0048d9addeba488cb522854d0c1f60e74911cc7b0a356524b8c423f6225b320392bdfb7e6ad74bc85f89d86c22e30716a0ffe80c7e323aeba1d1bfd5

  • SSDEEP

    98304:pX4FOjfU2T1e3v+L26AaNeWgPhlmVqkQ7XSKVtP5:V4FmMj+4SqP5

  Score

  10^/10

  asyncratnjratquasardefaulthackedoffice04discoveryevasionpersistenceprivilege_escalationratspywaretrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Async RAT payload

    rat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2