Extracted

• • Target

    ExpressVPNInstallerwin10.exe

  • Size

    47KB

  • MD5

    979fcde48a10a1571e55a0b47d0ba48f

  • SHA1

    1a765b75a45ec713a70a1b607df2928d47833b24

  • SHA256

    f41c426bff4474bc0669f77c4e0064dfe8ddb902b6c9a81f70e5bca78f9b3407

  • SHA512

    01a302aacf352d3c29d70f59e8efc3ba7ac1d09886afcbdb927d7f90e9157963bbc689f1dda6ecb7026815fc1e02d5717a205f92db95d364adba115ee437d321

  • SSDEEP

    768:juoNdT1LxHaFzWUfbmBmo2qbc4ZRihGZcAW2V4Fbgh0boiKTTy/mC/S3poa2+16N:juoNdT1LoG2WRiP2VSNbo/Pwa5VtdFf+

  Score

  10^/10

  asyncratdefaultdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2