Extracted

• • Target

    a027fa726a76a8afcac68958ff7f72d27d2067b9ec4c13d666d5825226821b8c

  • Size

    450KB

  • MD5

    15dd038348ef3ed32cd87b133099d3a3

  • SHA1

    f4715268ad9ba4b04b19336520f757c9f4b281bb

  • SHA256

    a027fa726a76a8afcac68958ff7f72d27d2067b9ec4c13d666d5825226821b8c

  • SHA512

    9dd03c4016df5f4640200abc9969b0065741a68ccbc47afbf6715e1b8b35155e995aa09d15c31572b0ae908c73bc88d3f0a7bb03b2b3845797c26c2620698dcc

  • SSDEEP

    12288:SODj9CW7P/njixh2wwh4wsaW0xRc6DYe8aQe76EaJ:/Dj9vL/jixh2wwhMZe8aGEa

  Score

  10^/10

  asyncratdefaultdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2