Extracted

Extracted

• • Target

    9955e237e5f00ca94109005a2d778a88641d25fef299864223fa835e808f2236

  • Size

    1018KB

  • MD5

    eceb6e1e8aa84e6501589dc1d3deb419

  • SHA1

    467a412530d7af26b01ec278d7d325e4b6dd047a

  • SHA256

    9955e237e5f00ca94109005a2d778a88641d25fef299864223fa835e808f2236

  • SHA512

    be256564941a092d73b6931dfa0a238b17d68c69e1742b98844e43fa3010db83bf9d52922912e127cd9b6cd1bbf9ecd39c4a36c2da676ca060bf21ffef8b27bf

  • SSDEEP

    24576:pji1+TKiRzC0NqgGApfkxIpePcvkTR8cvkTAU:pu1+miRnQjALpe0vkTNvkTN

  Score

  10^/10

  asyncratdarkcometnanocoredefaultguest16defense_evasiondiscoveryexecutionkeyloggerpersistenceratspywarestealertrojanupx

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Async RAT payload

    rat

  • Disables Task Manager via registry modification

    defense_evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2