Extracted

• • Target

    63d855658b466365a24661d02f253577d4339f1ce8f7a0ae48341b34603d7e1c

  • Size

    63KB

  • MD5

    e18f648682aefe8a256079fa8de0f4fc

  • SHA1

    143819f96aba2667775f72f113e50e72a3120cf4

  • SHA256

    63d855658b466365a24661d02f253577d4339f1ce8f7a0ae48341b34603d7e1c

  • SHA512

    20a6fa78743e32824af20b1c205045b81d2ac5afc59b8efc5342a6537bef268dea456ef41f949fb428f09162c1535da56800eea3048097695eb343f03f69ae7f

  • SSDEEP

    768:VFIsjMcAON78aHC8A+XuqazcBRL5JTk1+T4KSBGHmDbD/ph0oXS9yLMQqSuDdpqM:IgAOR9dSJYUbdh9S9yoQduDdpqKmY7

  Score

  10^/10

  asyncratdefaultratexecutionransomware

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Renames multiple (1268) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2