Extracted

Extracted

Extracted

• • Target

    92E44EAD94437A6F12BCD4BBF2E016BE0099B547CA78146272FBB16363AC3310

  • Size

    21.3MB

  • MD5

    223eb1433f7cd227555d88fc906c439a

  • SHA1

    0fdcb189fc89fffd45d686923e1dcd1c71f91444

  • SHA256

    92e44ead94437a6f12bcd4bbf2e016be0099b547ca78146272fbb16363ac3310

  • SHA512

    44689f5f849f2c7c1fb3af7919f42d5396006cbf5f12a79b186747e1710f6aaea52cd2985d5d7ae7f87ae63e070b7ed0bb9d1febd1954bcc90d4ee409b3492ca

  • SSDEEP

    393216:3ppWYSq1A5Jm69mhzyoEsDU6iauKgdBGaSbLb0Kr+B2p9Zey0WThqji7l2D:ZpWYvkJH97oMTKKG1Lb01gpvdyi7i

  Score

  10^/10

  asyncratdarkcometquasardefaultnetshareoffice15discoveryevasionratspywaretrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2