Extracted

• • Target
    2504a215659321d3ae08a94605f0a27debe810bca4025f68483584a2eafdf612
  • Size 45KB
  • SHA256 2504a215659321d3ae08a94605f0a27debe810bca4025f68483584a2eafdf612
  • MD5 3186a1a47088d6a5aefb3213bc0c4daf
  • SHA1 cec8cbc7c87acd437e7d8e75154286e920ec4710
  • SHA512 bbb38a69af454fd0174b5cf4839a97ca7232168dfe03d605fe13a02788aa51564283551abab062b3d6d19eccf05bbbaf8f92abcb9fc68767cb6fe75a827da888
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMSPI58jbJgX3iEF6v8ubdKaBDZsx:EulCJTHl42agG5MbGXSEF08Udsx
  • TLSH
    T163233C003BE9C23BF2BE4B78A8F26145467AF5633603D58A2CC451DB5613FC686426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2