Extracted

• • Target
    425066ddbc4d1eec17848cf8fa5265f24c6164f6e4ba8ec5bc210402cdb20962
  • Size 45KB
  • SHA256 425066ddbc4d1eec17848cf8fa5265f24c6164f6e4ba8ec5bc210402cdb20962
  • MD5 82b0c70c4fa700d292a03fad9d452268
  • SHA1 75bb8c258d11acd505ebb9feb9ab26a3d4617e7d
  • SHA512 4777e4f3ea2d495b9e87270234531f2f640c15906851749c2904c979bc95f303098fb556f3cf001a0fe9789a94e7f0238307c3a3e3b5517e95ac10abfa6ba69f
  • SSDEEP 768:gu61pTscmXLdWUpCSbmo2qrOGsGx8OHuPI2zjbSgT3ipnwZyRitkqh0BDZNx:gu61pTsHXB2xez323bVTSCywt+dNx
  • TLSH
    T184232B003BE9812BF2BE4FB89DF26145467AF2632603D54D2CC442DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratadwarespyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2