Extracted

• • Target
    New folder.rar
  • Size 16.2MB
  • SHA256 c5099e7bd4a63581755c0cda59324f651d646cfab49668b967612f898645731f
  • MD5 6ed3c78835481d1b69a2fd804a24e021
  • SHA1 3d70f65a8bb0e002c4a94634ab3c2807f3d1a041
  • SHA512 2eaa8f8ad30830fd58969a7263af82ec34420c3656eedda102b88a177c7b55a55e60a8db0d6d31d956fda346294a287a5405f55edae4a0b8fe3b68131ad32f3b
  • SSDEEP 393216:EBVb9UCPjkl6NPhLpQfA1deDAgQlByjZHvYhiB2yvB9:Y9nLM6PLdaUHl4FPYhiYyvf
  • TLSH
    T1B90733AFC70CA159BDADAD0DAB9507747CF93D36B9503D2DB29324E4638A18069C708F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  js-crypterdefense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistencepyinstallerratsuricata

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2