Extracted

• • Target

    RoyalKing Bootstraper.exe

  • Size

    39KB

  • MD5

    8c723a3169b077a877802649d7f8ad74

  • SHA1

    16650c695bc5966c50229c976916464e36d083bc

  • SHA256

    f9718b38ff60d7521a28816a474e2851537c67576c7c6c7b1c18f8ba3f84375b

  • SHA512

    aaae12062e64f6f4c503d73912bc249e08d20b0caa1fca51236e46818edcd1b9a56467b02ef15376baeaac3dbf8c9d01637498284d144d73d60808b12dae7e9c

  • SSDEEP

    768:cmQZqx1lYcJHNP1divdCxuoLZb69UJpJXbOfq1Ykjhm:c0lYXvIxJLZb6QzbO+jhm

  Score

  10^/10

  asyncratdefaultdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2