Extracted

• • Target

    aimr.exe

  • Size

    62.5MB

  • MD5

    9de2f7e5b6aec38fe08b447296413421

  • SHA1

    4e5dbfdbb5512c545abaff0b9561bea95f4abdd4

  • SHA256

    8c8bdba7313a236d8d90adffa63402ae96e1b2a6314713883a1a3832dc3fecfb

  • SHA512

    48e01b5698bd2bfb29fda2d40a166896aafbf9086fda89590af8f476686e584fc14fb464400c13488abf55db7be39d62bdc226fa95ce8456fb2a1112ddf82b10

  • SSDEEP

    49152:CbOWffF0ChpMq2yNO/6heTR8DgVmkLoqlfqcIjRmUwhD8aW+bX1aeTDjotOieZxG:GOfChpMq

  Score

  10^/10

  discoveryexecutionasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2