Extracted

• • Target

    crackers.rar

  • Size

    25KB

  • MD5

    aa7aeddc68534067f04cba538ff43423

  • SHA1

    36afe36fc4a16f8fe5a90971a5cd356b54b2e33b

  • SHA256

    6e037135b5dc8ce75267fcc8215a48041ef8ffa1409dad74799d1295b66f7321

  • SHA512

    e781bfd76a0e980c4502c0d8609c5d01494098bd9c80fce99202fdd35947c43885efaa311ab129109283830bf43656d55e60b14488b6a1b769899aba46b5d211

  • SSDEEP

    768:Qndpw8zHhJuqGMIJaPIrVszW18ZYm/UWGcqZSnh:g/w8zHLnDIMIrf8emYrSh

  Score

  10^/10

  asyncratdefaultdiscoverypersistenceprivilege_escalationrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1