Extracted

• • Target

    4ce381358bde90843640ac7cc0d59f4c4066adf1f26db2e6ba4130e9f72b6af8.exe

  • Size

    1.9MB

  • MD5

    1f2be558a74cb83afab86147e70d87d6

  • SHA1

    67aa1ef5fca4e3e720feb6080d0f1ac20b503b26

  • SHA256

    4ce381358bde90843640ac7cc0d59f4c4066adf1f26db2e6ba4130e9f72b6af8

  • SHA512

    5f8af4ea3bd3a5078b91d086ef1d4d1a9d88f2065621eb76ce21573e02144deab5f6e33d65a0525caff1387e5bbfa1ea4bb3f288e60045efcf7a82d5f57e87a9

  • SSDEEP

    49152:33X/qQfkYzgrW/r1DNKHOkjSKwgRVRm9SMHGVa52a:nTfccDMRSKTVRmQi3

  Score

  10^/10

  discoveryasyncratvenomratdefaultexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Async RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2