Extracted

Extracted

• • Target

    uPh2C

  • Size

    58KB

  • MD5

    705e54950f28c565dbe4818eb2be7423

  • SHA1

    19ff36dbb676a64197e0a645adf317d2b9cc17d3

  • SHA256

    0844465dfa8bb241f452c320bc6caf6cec645b461dbcd468a2afc9dc900e595c

  • SHA512

    cc9b21272ba9a2fa038a82c8206303575ce9374f1275b9c394407828c475789616e914befecf58e25c94d451fa92d5a313a611188516b4120015846dac56288f

  • SSDEEP

    1536:a0vDHXpEjO9Xwq2Sk6e2Nhxdd5pdLv+l/4QmuWOMP3HXpEjO9Xwq2Sk6e2Nhxddi:aoDHXp+q62Nhxdd5pdq61HXp+q62Nhx6

  Score

  10^/10

  executionasyncrat1discoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2