Extracted

• • Target

    sasasa.rar

  • Size

    52.2MB

  • MD5

    59f794fea5bfd53feb55c754cf2b1a52

  • SHA1

    2878304c317d05daff6f30de640ab64742b2dd77

  • SHA256

    0c4b7a3670f4ef5f7ba2d7e820cb3df837a72c08a4d039768b50617c06983308

  • SHA512

    2b48c5160a7d2ec0c67c1ed119e666a8a509f64b43f94835a77041e58d025dfcc0df7a969d2cf83c9a1453fd9e5f0f4fadaf7975c4e1255b89f866fac785fc6b

  • SSDEEP

    786432:SRbg1VYxvtPUpHOL7Of0Ub+yoAoxGfMvJLniIroQtC311gqkYdGYD0AWWQQHp22C:SBTdL6f0UbnoA+LzZgqxQHQQs2pemJC

  Score

  10^/10

  asyncratservicedefense_evasionexecutionpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Creates new service(s)

    persistenceexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1