Extracted

Extracted

• • Target

    Windows Defenders.exe

  • Size

    82KB

  • MD5

    c83eee916e8a78f97511dd3bce5fd38c

  • SHA1

    0748ee6c65a2c401b8641d39cfff57e087f62154

  • SHA256

    c93d11c96d20e8b20cff7cd018440fa16f6601c047890c48c7e72cb5e0077e02

  • SHA512

    de60264ce73d09266727d5b8be3cda669b8e5f2ae2c68c09dfc9e6f1cfcfc512a3abba459cd55a63bf7f0fa83136bb6d511a16ff7553813a799446faa27f5b51

  • SSDEEP

    1536:gD9iBlgS19xE2VE8NVBxcEu6+rFanqNy7g4FY2qNlnw:gRU119rEMVAEX+4KoFRt

  Score

  10^/10

  asyncratxwormdefaultrattrojanpersistence

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2