Extracted

• • Target

    EU.exe

  • Size

    2.1MB

  • MD5

    84714242749ee3c7f626d1e9684e391a

  • SHA1

    f17abb2ab4ff1bb08360420c73e4d9496045ac1e

  • SHA256

    3c65766763fc26ba80bd11313a587f3e3206f9ba3fea6a39decd66a700cc9213

  • SHA512

    513010ecf933aaa85ae887b59aa03b8ddebc406cdd9ae3b889fdb2768ab33e363f81d17813e5caefe42e57162b45a81097a95723345e232b288be432150b4a28

  • SSDEEP

    49152:n2mx9FhsvlnBh5WYNo4QP6Dc3V0bO2EYTRIagYDitK/z5:n2m9WTNopCDc3V0bJE6RrHiE/z

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2