Extracted

• • Target

    81cc95ed86dd840e6d4f9381d54a49345d6c329992bb10f578448e68de10b108N.exe

  • Size

    544KB

  • MD5

    4ab04f6128ac78658115bdf49e842030

  • SHA1

    bc3895eb9080d2be42c6a3a46f6ac5ecd27b54fd

  • SHA256

    81cc95ed86dd840e6d4f9381d54a49345d6c329992bb10f578448e68de10b108

  • SHA512

    054acca118b1cdbfa081e1558008a17de9b08bbf028922b3c54bc79b79d2df826f78f23e0d242bcc3ca7e533635de5061afd42fe9254eb9b26dc9430b19ec236

  • SSDEEP

    6144:hHL4WOLSPswA+PjIMcTCRu9DWoitq2+nVE7pSwqPNq:uWO+PtBPj/cWwpYqq

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2