Extracted

• • Target

    GWAesWUtovxi.reg

  • Size

    89KB

  • MD5

    323c88be877acaf1d30d09455764f565

  • SHA1

    c0e83aa25be2983b57b769f45020aeec0d21dcca

  • SHA256

    92148c6f69a95bed4abcd9efb43b89f0bd7287b4f418583f0008771c72699386

  • SHA512

    559b4eab3c757adefc350b6e18c856576b7f6135e322362e8e2d109d86cf3e0bbcf845a78b13fd21d9b70eb774f211c7c5e360afaac1dc0793fdd3f88dce7a49

  • SSDEEP

    1536:kram9i90orQOvnklnTyFKEnZ4DE3wE+nM1akaATP93HOl7GrF6a/ktxooow+:kramI91nkBsfnw4TP9XOl7Pptuoow+

  Score

  10^/10

  persistenceasyncratdefaultdefense_evasiondiscoveryexecutionprivilege_escalationrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • System Binary Proxy Execution: Regsvcs/Regasm

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2