Extracted

• • Target
    42549d2da8c17393c0425213f891c7173f917323f2af97ef4ddb18b37d19c06e
  • Size 45KB
  • SHA256 42549d2da8c17393c0425213f891c7173f917323f2af97ef4ddb18b37d19c06e
  • MD5 ed54c0a3de8803c09011a4afd900c3e7
  • SHA1 bcb7631f5654ddedc3bf0612899d9f5d1810c43d
  • SHA512 cc24a43f9c963bd234e78c10cb7bbe82ef02395621e76d4e378564f7564eb62416d3648fa3e64fdeeb5ead67092df2dabfdb0e897f27807b0d626dfcc98c830b
  • SSDEEP 768:MudApTNctooWUS7C+mo2qtsGFZQjB4PIFfzjb/gX3iv326fDWKPN3BLBDZIx:MudApTNmU2kqF9Ff3bIXSe6ZfddIx
  • TLSH
    T10F232A003BE8812BF27E5F7899F26145467AF6733603E6491CC451DB5723FC68A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2