Extracted

• • Target
    329fce6bc759d33aa33972ccd11368ad7b42017e8d5af02ecd4f2a539b7b6781
  • Size 45KB
  • SHA256 329fce6bc759d33aa33972ccd11368ad7b42017e8d5af02ecd4f2a539b7b6781
  • MD5 752cda3cf4c85f73af54e3cfacc7ab08
  • SHA1 a85a9fc8001d48f7852c28a7e47d18318c029b4a
  • SHA512 ad360c58687dfdac75915b5faacbaeb3a16232299fb9456940217029e6a77ec8f7c3ba5b7fe1c4ff310aba40103eb5dc556730f1142ea0ae614ec643c5d4d86f
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5oibbb6TN8/nPI6WzjbcgX3i9/wvKmiiyCE:ku40ZTXEb2TeEqTNKA6W3bzXS94CmvHp
  • TLSH
    T16F232B003BE8812BF2BE4F7898F261458A7AF6736603D54A1CC451DB5713FC68A52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratadwareransomwarespyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2