Extracted

• • Target

    Invoice_Payment.exe

  • Size

    1.3MB

  • MD5

    b1ecdaa42fc6ad9401ca1280d72ebe06

  • SHA1

    5610ce51bd1268176e1c87f4eba2399b9306773b

  • SHA256

    05a06ffd09151298fe40ad89b1042276f8166041fb81064060ec8344013bf3c5

  • SHA512

    57e52b040deb2f8e46be5327bff20a93ec520d5712816ddc8251260c94b4fd6e12fb361488f8c01d31f890364a198491d567be5950b441f924a1e3abce3b0d52

  • SSDEEP

    24576:sNA3R5drXPUP3m31yGejSrrB/O0AP1PLJVssMIjnglWGzMuxHVy0kIiWT6geGKH2:t5223XesrB/O0APOsBMlWaMCARSuFGKW

  Score

  10^/10

  asyncratdefault02discoveryratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2