Extracted

Extracted

• • Target
    kop.exe
  • Size 157KB
  • SHA256 20da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c
  • MD5 8f8743131055e1e181f7d7c4ff527065
  • SHA1 92ac3b84d67138f1c98d3b6a9764263550f63dad
  • SHA512 929ebb25605f0921dfb4944fd00807540c3ec5a93ef2d29d34daf2cb7897377ee82b7cbfef8db89f9efc980738854fd67588350d5427e38619679f26731862a0
  • SSDEEP 3072:gKqV65eA/58HvPiWgA5TZ0rbU6MzuXDE478n0IuLG3qT:jq65j/58P6WgA5dkbLMzmf80IuL9
  • TLSH
    T15CF38A01E0E4AD0ACFCF623610F8DB059590B94EA1779188B9DB60E719FEBD4DCD32A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  c2discoveryasyncratxwormrattrojan

  • Async RAT payload

    rat

  • Detect Xworm Payload

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2