Extracted

• • Target

    AIM-BOT.exe

  • Size

    9.8MB

  • MD5

    ac85a22feba5e3aa51dec6d867d54081

  • SHA1

    94f8dd4ec1465289935b626bbf12d5fd6755f40a

  • SHA256

    78d7258c03f6f988b20803982bdbea34f7b2a2089f81bd9ed9fcc14daedded48

  • SHA512

    a0c227a996020e15aaee7b58a499711a29ea6f27002d5ebf3ea05a061688755903d191851cf68f159878b2b9ce3854e6c3b04ec6a3a41fd8d7e90fced4bed4a0

  • SSDEEP

    49152:huSvYfx7jJWLuTtutUAesgLH36HcJNI/GjtPw8Ws89cU210W9zY/bsiJhWbzZmUm:8SYjJWLu

  Score

  10^/10

  discoveryexecutionasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4