Extracted

• • Target
    ratware/injector.dll
  • Size 45KB
  • SHA256 8de517a3447c7dc4a8944180394b36f9fe01cd823eb9f5a4f6a110398761539c
  • MD5 6528a0f149040d979d0a3d0e805d5844
  • SHA1 9cccbd9883cfa916a774e87658d51fe7e63f94cc
  • SHA512 dd8789f9d6d3037280ee0b5d8aa8e865a39a9df205d652034729695fd89e5488708f4e3245856b20a5de29e8404228a80a0416d94a156b1e6e26adfea9ff5839
  • SSDEEP 768:GuYHKTsufqG9vSLjWUvlPRmo2qbUKjPGaG6PIyzjbFgX3is9xwBEUMkpBDZmx:GuYHKTsjMvSX2BKTkDy3bCXS6wBtMk3O
  • TLSH
    T19A231B003BE9812BF2BE4F78A9F26145867AF2633603D54D1CC441D75A23FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratadwareransomwarespyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    ratware/launcher.vbs
  • Size 58B
  • SHA256 799e318815354252d4e46997c5bfb0686aa0f4011c700ec1442643154ef0795a
  • MD5 3a0d0d40836779a776b9f6821864e7fb
  • SHA1 f9a881a019427f93296301be1cd86bc0ab269838
  • SHA512 5ea394afe34e5484860775bfa111ae2d1ed6cf36c7c9b7a904fe873414c1ca9b48d15f65e3634e1b0d2b7a955d880cef693b1474f2a85a01ccc0df7ba94184ac
  • TLSH
    T123A002057C08D6A951E4819445308D48A98498955110E61A56A09699916BAD44615841
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutiondefaultasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral3behavioral4
• • Target
    ratware/settings.bat
  • Size 1KB
  • SHA256 05f667da8c93c5aedc67390329091ca59ae32af466a54dd0c6781123ddb36588
  • MD5 ab988cb4b939d0fc0c518f072189ae9e
  • SHA1 eba28d6825ab6623afc1fef544ad93ecfa3a516b
  • SHA512 3698d5d6e2213bbbaf581c1b6db962fdaaba019e2267e00b80ea931953b78952f5abb90f66dddcb477cb50f2cdbed026a72067a0f643f2695db179c8e9f884ed
  • TLSH
    T13821EF6B0287807243A625824F3D19FBD51F87F78A2672B23ED464C53B1F389AB94DC5
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratratadwarepersistenceransomwarespyware

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6