Extracted

• • Target

    Doc_16811806711348617673558987317572681097380136281.exe

  • Size

    1.1MB

  • MD5

    f5c33c21056d3ef62172fc876faad063

  • SHA1

    fb56e9043f19afdf49c61063ba30fe0ad72daf07

  • SHA256

    655c37dadba41474eb3447ff8b23e064e760013e7c84503f9eb25d21f8bd3ec3

  • SHA512

    aa29db436c336847d04b7317a1d8a4cd5c8335db1d2235fb3bb685a7907fcdd8cec8eca8f2818bdc8e1e61c5bf265978e692ffeef766a962a9b7406447afd3c6

  • SSDEEP

    24576:PMjhbhcgdHRQp+DKjHfEhZQntmXft63I3i43eOooZw:CpeuHhZ7Q3q1Zw

  Score

  10^/10

  discoveryasyncratexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to execute payload.

    execution
  behavioral1behavioral2

• • Target

    Doc_16811806711348617673558987317572681097380136281.exe

  • Size

    1.1MB

  • MD5

    f5c33c21056d3ef62172fc876faad063

  • SHA1

    fb56e9043f19afdf49c61063ba30fe0ad72daf07

  • SHA256

    655c37dadba41474eb3447ff8b23e064e760013e7c84503f9eb25d21f8bd3ec3

  • SHA512

    aa29db436c336847d04b7317a1d8a4cd5c8335db1d2235fb3bb685a7907fcdd8cec8eca8f2818bdc8e1e61c5bf265978e692ffeef766a962a9b7406447afd3c6

  • SSDEEP

    24576:PMjhbhcgdHRQp+DKjHfEhZQntmXft63I3i43eOooZw:CpeuHhZ7Q3q1Zw

  Score

  10^/10

  discoveryasyncratexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral3behavioral4