Extracted

• • Target

    8a2abab20bf75ac19eaa73be3b09219d.exe

  • Size

    455KB

  • MD5

    8a2abab20bf75ac19eaa73be3b09219d

  • SHA1

    c0fa652bb151644bf76b55f3c9d68cb5e8d7faf3

  • SHA256

    866ac65940057d6e1a125eda23a12d6743d75e6ff3a74ff6d53debb3fe90a368

  • SHA512

    e8842b9f47a5dce906ddca3dfbb608eba660c80364ed0b02b48c33e161df3e95226d713177733e7591cc7eccecb3f48e1a731576a90d6fbda194de98de5495c9

  • SSDEEP

    12288:gPn4HHOqpc/Xzm9HtpiuJZoEMkEbSvxJxhF3eggJG:gPn6pc/WHtplJCDkE2/PNz

  Score

  10^/10

  asyncratdefaultdefense_evasiondiscoverylinkpdfpersistenceprivilege_escalationratexecution

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Modifies WinLogon for persistence

    persistence

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Stops running service(s)

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9