Extracted

• • Target
    5dc358171478d4c9d973dc654574b41becba04c7115b604d39dae24233ba1271
  • Size 45KB
  • SHA256 5dc358171478d4c9d973dc654574b41becba04c7115b604d39dae24233ba1271
  • MD5 49ccd29084511a689745d48beaf86b8c
  • SHA1 6b970882b6ff3b1a124a865aad1e592be8917038
  • SHA512 bc997ae3edf6e431348ad591dd9503d024679f16c473652c8076a11518952489395327b35d7e864bfca42bde06c65fb649052ed5cd02d5201dc0a10bac0bb1fa
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA8H0CnrQRPnH8PIEzjbagX3i/8haFLm5YteTBDZMx:kuSOpTPOP2MfnkdBE3bNXS/8haFLmya8
  • TLSH
    T122231A0037E9C12BF2BE4F78A8F26245867AF6633603D54A1CC441DB5623FC59A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratadwareransomwarespyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2