Extracted

• • Target
    4ea22b8bbe2454d7993867296c8ded01af5edf2816f5d77c7e58f08be6fc570f
  • Size 45KB
  • SHA256 4ea22b8bbe2454d7993867296c8ded01af5edf2816f5d77c7e58f08be6fc570f
  • MD5 e0e7a072ca6b7cd2b743c8ea8876a73e
  • SHA1 f671e05ad8474a1afc87f1eaaa10986885902a9d
  • SHA512 daddc206d3af66d4c35b5dd99505977ed59668ed5fea94b5d1a6d8dc34fa743388c4f12092c998cb1f31c3c099599f1f731c0d50d77d12efd688dd7fcae3328d
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI5zjbWgX3iv8bt7VOZGFBDZ8x:0u1YJTHcw2NgG53bJXSExZLd8x
  • TLSH
    T126233C0037E8812BF2BE4F78ADF262458A7AF6673603D5491CC4419B5613FC69A42BFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratadwarespyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2