Extracted

• • Target

    b3ce538a77c86b1f9840d53e42999b9535ad74d83e4b00e527193c963ddd0035N.exe

  • Size

    1.3MB

  • MD5

    3a9f8ec832df29647e58993ca0e7c160

  • SHA1

    2ad6a8340261823adb53b066007d4a39eba35ed1

  • SHA256

    b3ce538a77c86b1f9840d53e42999b9535ad74d83e4b00e527193c963ddd0035

  • SHA512

    c4062c4ee074f53eef3123a5e3d922f87cb87657bef62338339eaec6d6ae57e0322627db0f83751b0b3678a4d230f23a3ee2776897231b9fa9f912c8078de123

  • SSDEEP

    24576:VMjhqBd3X3R+wTqM6FWEn72mHvKgcLJj3gSPWbLK3AtIT2Awyfc7MEYbO:MEBdH3dt6gmHdclj3IK3zT27yEbYa

  Score

  10^/10

  asyncratvenomratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to execute payload.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2