Extracted

Extracted

• • Target

    58cea87c2baf7227f19f5895064efcc7a410cc64f809648d79aabe4a1e7ea210N.exe

  • Size

    372KB

  • MD5

    f9646131ff6c7b07e435791522b418b0

  • SHA1

    c0b1be54b2915cc9df1011836402e981a5815c92

  • SHA256

    58cea87c2baf7227f19f5895064efcc7a410cc64f809648d79aabe4a1e7ea210

  • SHA512

    44b54b19f35b3aca440eb09b8babdd3b22bc934145857b24a91b6fe65f1a6b2106a4a49266c55552135c63f8b8f85bc7a5e99d458cb277e2216ab2b20da089a5

  • SSDEEP

    3072:uD/0ZYthTLJRMB4IVGubl4m5plDzGuX7i2me4F8lpo6wB408ko/Z5hwy6q//kgrh:PYth1RiVGubCYfacu2tB3oB40zox4cf

  Score

  10^/10

  asyncratvenomratvjw0rmxwormdefaultexecutionpersistencerattrojanworm

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Vjw0rm family

    vjw0rm

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2