Extracted

Extracted

• • Target

    333.exe

  • Size

    65KB

  • MD5

    5855063b0ae049847b1d9eeced51a17b

  • SHA1

    17cab3ae528d133d8f01bd8ef63b1a92f5cb23da

  • SHA256

    62f8cfee286a706856ebe02b176db9169ae776c6609c23016868887ea6b0ab98

  • SHA512

    c24970775e8da3f46763824b22fbccdbd2741836cdc3bd9966ef639db8db28cb1b888875da2babab037df6e26e5774f475f55ba10b6f354504185de4d5f4713f

  • SSDEEP

    1536:VjTDKqibq1iqHNTcNbRn8smHeC403WAx:VjTDKqibq1iqH6NbRnyt39x

  Score

  10^/10

  asyncratdefaultdefense_evasiondiscoveryexecutionratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2