Extracted

• • Target

    Documents.zip

  • Size

    3.7MB

  • MD5

    80c42af0016b3b7c249feda15f4d2cc2

  • SHA1

    9cb356ad7d4a6b1157b0066466b6606218c5b5d1

  • SHA256

    d60c30dc0ac1933eb3a28a42b8c9aa8b381816d64217393adc2f06e3deddae39

  • SHA512

    98ace938565688472f0ef4e47a531d18eeed41025894c9a039c154c075344aaccb023aec40c7cc65b2ada8b3ad0d88ecb64bd0dbd0f304cea1f603fe0deca70a

  • SSDEEP

    49152:PO5JIDWgbuK+YLbRy2OnukNoEZok1zE+kGDR9OTVOUQZVv61hG0Byx/tEsF07J4z:25qBh+rB/1ow/OTVOUQ2+xVE04J0Nwz+

  Score

  10^/10

  asyncratlink skipper bdiscoveryexecutionmotwphishingrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2