Extracted

• • Target

    injection.exe

  • Size

    264KB

  • MD5

    a0051fa6f5190c984a269d026a47e7b4

  • SHA1

    380cbbddfcac3fb22bd78f60bf8445f1f1634b94

  • SHA256

    7d739906ed3602a3617329cf9a8c314c4bf0cb898923e53137d6b25b2e3e4595

  • SHA512

    4cc10e504d5351fae69e3a918a9fd4386e10f3e73723ad84989e2fe23ac32fb3e60bfd3a6e777e7bc17f448331393774e31570596ca270307f0d7a250e00d1e0

  • SSDEEP

    3072:Vj+C7lQ52Mrb/x5xrzQdUJ+fYy8xDVY6OVfNoteAPEHBAnpK37nXx8b0uaQ7nlPt:V77MrvxAdU+IFXOOev8tDlPOvXzx1a

  Score

  10^/10

  asyncratdefaultexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2