Extracted

• • Target
    cd079eb158201bf5bd073af74fa80c267bd1f5186ac0361b9d843144b8573116.bin
  • Size 83.4MB
  • SHA256 cd079eb158201bf5bd073af74fa80c267bd1f5186ac0361b9d843144b8573116
  • MD5 54619b8ffd2d492b7428062c3d6e2fe4
  • SHA1 8cbe4f9ae747ec4f4e652580ac4825f1aa3fd957
  • SHA512 c02729f9a8d48314c1bfcf023284b947a01883231e91c7bb282f4ed99a200e2db53c123c418125a320a6dfc98b8e62dd33d98de7a2a426db4b10b841d4d9a884
  • SSDEEP 1572864:lq1m7X/nVk+I46tXLsdrtkUINoknsul7Vj4NKK1rYcMjPHJX4Ep5yIljZaNEdP:gmPVZIRXYBkUINDlx8KKVMjfJX4Ijlv
  • TLSH
    T178183343A2DB80FBD2D7993C4A0AD811C979BC355B959FCF524218BA6C1BBD0C978783
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratinstallerpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2