Extracted

• • Target
    7d4379db048b1c2033bb40da89f773c0916732279a7a0134e692fe0cef64e32b
  • Size 45KB
  • SHA256 7d4379db048b1c2033bb40da89f773c0916732279a7a0134e692fe0cef64e32b
  • MD5 d4e9c38ab5adfd2789ea05f96756a190
  • SHA1 3d028409f79a14ea8dedf6e2e3872c525ee871fe
  • SHA512 4749632aa0becdcd845aecb59375313c45bc59585fb1b0573e4e3d7de76acc0e028c1c8c253f9c85e68676ca5b65fd307212d43c0f131ebffcbcf01aa3f46a85
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mbT0GYjHuPIpzjbigXFieBaCGUUW5qfXiMBDZUx:cu6YepTPso2js/3p3bFXUeBaqR0X3dUx
  • TLSH
    T1C3231A103BE9812BF2BE4FB8A8F26105467AF6637603D64D1CC451DB4623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratadwarespyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2