Extracted

• • Target

    0b525c4353772a037df1a5815c64919b42b03ff92f4cb6a445367f46b7e82fd9

  • Size

    909KB

  • MD5

    9da3fe2dc92314bbde5acb9fcc5ee627

  • SHA1

    67338ae6eaefbec732b72a31c909c4f9f3b09b56

  • SHA256

    0b525c4353772a037df1a5815c64919b42b03ff92f4cb6a445367f46b7e82fd9

  • SHA512

    ba5291821715d572d19871b494538d4a8cb68172518bdeb3c232740e31c9b0767ead41b1c234b56860a439e28d804b8fb7d41ddeffc943dd6b06cc1f4eb241b6

  • SSDEEP

    24576:Gf+4JO2iIzJJ4//3Udkj/9/5//sveidXG:zC/ii4X3Qk3M/2

  Score

  10^/10

  asyncratdiscoveryexecutionpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2