Extracted

• • Target

    da58732f8c52ededed023e7d604dd10e295ad436884b990c8f13e6660cc42b5e

  • Size

    264KB

  • MD5

    3fbc9d18f8e94a0b5b1e39134be7c153

  • SHA1

    be9a946fae242ff3b59ed41e0847338dfc90c58f

  • SHA256

    da58732f8c52ededed023e7d604dd10e295ad436884b990c8f13e6660cc42b5e

  • SHA512

    3909f08fed81bf6ff84c30ba531a098829dbc6ff54718abd79bb191e8d00ae7b8fcc2c0717c47bf1f988ac9cb197cd41283d9f8e78a3cbfbbcde68fcc251762a

  • SSDEEP

    1536:AvT4sMnsXsJk+74w76OwXLCqGO7f3XFPzm+efcYqJznK5Fb5uDSPVZrskXUkRhto:ev

  Score

  10^/10

  asyncratcome00001discoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1