Extracted

Extracted

• • Target

    BED020CBBA2610B31AF66357DB97C10C.exe

  • Size

    95KB

  • MD5

    bed020cbba2610b31af66357db97c10c

  • SHA1

    d4c68500e5f8125b60976af885172253a435cc78

  • SHA256

    56d98688e5aa501787a31e98f9666b80002bb692e793257bb3a6f6f9cace8278

  • SHA512

    08fb0c1fa421dbdd61aa57d2adc7127cf7def12e88db054515be18ec05207e6f93ad775316137267d77e987e0145439e293af4784eb9b17826d9cb39fdedd931

  • SSDEEP

    1536:6GCx35SC0o7Yrcpv41Efir+XKEkRi/gN2ieJOW56+Cj5sVMH:6GO35SBrcpgSfPLkEybeJL56+CtYMH

  Score

  10^/10

  asyncratxwormdefaultdiscoveryexecutionrattrojanpersistence

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2