Extracted

• • Target

    EXMSettingsRestoreUtility.exe

  • Size

    122KB

  • MD5

    15f043fb9ac824a896d33502ce43a501

  • SHA1

    e8b8ff0633441603405bf83e57bafa385ca0e784

  • SHA256

    59131a7e8725c4de5a4e1fe5e3febf9f861c22f58ad0cb179bf4d2f419613abf

  • SHA512

    7e9756b1694be946d460d37188e9d193f3e128abe692ca770ef6893f8979800b017b23d4d4a42d6fa546bf12c5f495b3cb6e2fa866e1b805b8a997f50b46d1b9

  • SSDEEP

    3072:Um8Y3AavY9QonIV6fAaCTgDEZ9DAxpz6+l5nlKv0Mp5:U23tvYaeIk5CTgDEZBMuw5nlKvnp

  Score

  10^/10

  asyncratvenomratdefaultdefense_evasiondiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2