Extracted

Extracted

Extracted

• • Target

    00f0c2f3687ab8bf0990084d1e3af62246005c32084fa598aca1d65bdc0740c9.exe

  • Size

    6.1MB

  • MD5

    192bcd791eac82426c69c1496d9059e5

  • SHA1

    036019f9b93f2b2cb80fa251fe769203994e0ae2

  • SHA256

    00f0c2f3687ab8bf0990084d1e3af62246005c32084fa598aca1d65bdc0740c9

  • SHA512

    e774a0a47ec7931a1928ac22f54c65089a340e24cb87fd9b59cf64e8ad203e0bd904da997318ff5c9f0aceddce70dfa415bfae053d97db374adff7cbbe03d3e0

  • SSDEEP

    98304:66nonNZnR83jP+0g/7/DXj6Bi/cwIofEbo4P4HwsffoOX1g8:6WATR8zP/gD/DfP7WqfoOq8

  Score

  10^/10

  metasploitbackdoordefense_evasiondiscoverytrojanasyncratgurcudefaultratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2