Extracted

• • Target

    Demanda No 2024-125421208.exe

  • Size

    363KB

  • MD5

    b6241e5b33792a2e0dd50c64ec3b02cc

  • SHA1

    fb42827ef55f27a81226d8f4d79be7c018646089

  • SHA256

    148806d795bae49568e4f2be94b53f067b6ee1aa67a5ecd9cb9ac21ea60a37f5

  • SHA512

    8cd94183b1696fae1862bfa0c3a254ee9d14f5d101c2a822c1058afe67edb469980b8937227a3da578fb1a968287f59858f6572de8629d91d7d0ab7ebaa70aaa

  • SSDEEP

    3072:rWWe7EIwyZUFSxwpzwr7xZppZsyeKjuOuVk9FB6mIqloS7rOCovd25UvWdITg/tX:AZHewr7TxsxKxFcm3frzovd2eGOgmK

  Score

  10^/10

  discoveryasyncratn12executionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2