Extracted

• • Target

    ohiforgot.exe

  • Size

    74KB

  • MD5

    e061a0b37973b6466a192f1d18fd513b

  • SHA1

    f884c6c06ef6109aa737ac9b67c7c11b73294e4a

  • SHA256

    49e718675e880dc00de6fff1466604de8df962207861a54c83ff99a070512d31

  • SHA512

    90dde439124f2db089ce0d0b88da3319d083ff90b84a6f7309a9b19e77873b8ddc37a5621307dc4f910511cbcdc4a85c238024c39ca811c510e76d29086046ae

  • SSDEEP

    1536:2UaUcxoyR1CriPMV8H2sICH1bX/VskQzcaLVclN:2UDcxoyXkiPMV62IH1bXukQLBY

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2