Extracted

• • Target

    profile

  • Size

    12B

  • MD5

    950c9307757339e4b6eac6b773718444

  • SHA1

    f7caecbf683a59969b8d56ec7284564cc9aa4ae2

  • SHA256

    554c2d37a4ed23371a564108929fc223291b61bb4df60d5382aa4b3c53c280ae

  • SHA512

    a617c4358ed81d3ed74098743db514f080365e3db25c8c99d3cce1582dce90f498ccd93d637313550d18f19a9250d75bf09ef70781361cdf9a3b0843f408350c

  Score

  10^/10

  asyncratdefaultdiscoverypersistenceprivilege_escalationrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1