Extracted

Extracted

• • Target

    8a152fafb45bac4e1e02ecbaffe29d624d8457c431dd4eae67dd5a860cef1a47

  • Size

    7.9MB

  • MD5

    198317942e11f130d2c6f869e4b7d2f5

  • SHA1

    388a20318efa184a8e0fdb62db76ec071dc7ed22

  • SHA256

    8a152fafb45bac4e1e02ecbaffe29d624d8457c431dd4eae67dd5a860cef1a47

  • SHA512

    d437db9a575d883ff29f0d2968b762e255f619ce9a84d09eb77bca94e5b5481a4200ef80657f8e8ef5f8f134b17fd65da4a3063710bf4b222b8060464935fb53

  • SSDEEP

    196608:qTZYpV3/wqqL0xvyMfcAJook0smCeWRe/HYupM/Qlrd:R/wp0xv7kl5s/H36ol

  Score

  10^/10

  asyncratxwormdefaultdefense_evasiondiscoveryexecutionrattrojanupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2