Extracted

• • Target

    DAVIVIENDA - CÁRTER FINANCIERA REF. N ° 0939495954.exe

  • Size

    4.3MB

  • MD5

    be9070cef329332f8afa74c091d2ef15

  • SHA1

    d1d836e7885404d6986e39907c361f3eedb76b5a

  • SHA256

    9f5a7d655c1227e0ea7e7409d1aaefb956d3655c6125b757fc000e3eba8b8ea0

  • SHA512

    2968ce1d7daadeb3bf551600cde8273a57a79ed443fea16104859d40de4b2ab28e69bd6cf3e5dab80101cbf4c192bdd8e152630bf78093d17e094638554ff6ed

  • SSDEEP

    98304:vCxRXOhEc2MgYHTpnDUSU+zjsT7jpe6B5j:vphd2MgexUSUEjsT7jpF5j

  Score

  10^/10

  asyncratchinoodiscoverypersistenceprivilege_escalationrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1