Extracted

• • Target

    cede04b7fea82b617ddf512fe1ede907ec6ea0e88c0fbd416636843abe2f4aa5.exe

  • Size

    544KB

  • MD5

    72f75a45c5a2dba67de3552b48b83fb2

  • SHA1

    89eaaeeca99407019a85e5c8e950f2d47fe8157b

  • SHA256

    cede04b7fea82b617ddf512fe1ede907ec6ea0e88c0fbd416636843abe2f4aa5

  • SHA512

    9146102fb862d0b9a8c0fbefabd76e0963d33295defe1a53bc4efaae724583f2552490f97df440d6d09e4c97a3b7c526f42f81a7ea3bc2691a063dfed4779254

  • SSDEEP

    6144:hHL4WOLSPswA+PjIMcTCRu9DWoitq2+nVE7pSwqPN+:uWO+PtBPj/cWwpYq+

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2