Extracted

• • Target

    Loader_protected.exe

  • Size

    115.3MB

  • MD5

    a78d4a3ed6f43c1297f185b7d18c2edb

  • SHA1

    6ccb95df6640412942d3ce4de1bdad5143997187

  • SHA256

    2f08bd6ce9b753fe7e99fc93caed4c1eddbaa36166f18d2eb8a59baecdbf297b

  • SHA512

    c029e4aec1bfc11711b304f32f3dd5c9f2f011c6a8e27f570b67b6038a1fbf8b0a9a788a3bc89ae07334fd99bb3263330c7f036bf9cdd7db728ba8bae7be8f75

  • SSDEEP

    1572864:4WZIOl649JXX8/17pz6qbtk7y5bi5j/iCZBWyYLWwNmFAHlsmiL:4SfJtU17pzTDQ5j6CZBR+x4FAHls7L

  Score

  10^/10

  asyncratdefaultdefense_evasiondiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2