Extracted

• • Target

    4971_output.exe

  • Size

    10.9MB

  • MD5

    3081ad9d2fb1f02a8cddd261ed95c27a

  • SHA1

    06d417baa8a51b0ce5abda41585ec5bd1387df01

  • SHA256

    78c7160b3deab315fa79208f9f144f59cb25001cac18354b11050393c8bf9675

  • SHA512

    60baba1096d8efd05ec911e737ee5ede8e844266c23eb12a00bd1ce003ae53539dcf1378990790150f0a14a92fe32be17d3772659d0acaede2593c5572b7a23b

  • SSDEEP

    49152:HcrQofT6qeSsPJhDx8IhdyFNOPHf0fR0K049XwIVhaT6hAp1uMmRgDidZL4mb8F2:8rIqeSsP

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionpyinstallerrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3