Extracted

• • Target

    233fee4945229292aef7f2a515ddad8a0a6b1ccbdc40bb2ae9f343c2d96ddc8f

  • Size

    821KB

  • MD5

    40173279dca40dc2eb04e130d7142ce2

  • SHA1

    a9d3cf03484120a0471d14ba59f82b38d26d84b0

  • SHA256

    233fee4945229292aef7f2a515ddad8a0a6b1ccbdc40bb2ae9f343c2d96ddc8f

  • SHA512

    db2aa317e12095ab880ffa4bdd00839b5fd6ff86c3f9a1d69a5459a626a72949b138b757fc01673a46f298073c5e489ec7929b4cc440d4f9c0ef65abfbea9d5d

  • SSDEEP

    12288:dMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9JhBBxdsP2g:dnsJ39LyjbJkQFMhmC+6GD9X5dsu

  Score

  10^/10

  asyncratdefaultdiscoverymacropersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • VenomRAT

    Detects VenomRAT.

    rat

  • Async RAT payload

    rat

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2