Extracted

• • Target
    Подготовка проектной схемы_pdf.exe
  • Size 5.2MB
  • SHA256 a9888d884548b6f240f51a450286cdc7e9a5f499196564465e7d168b43a0271f
  • MD5 f0791b30e6bdfe3cb0356306b5da0e85
  • SHA1 e52bd0dd40e5a4b6f9363476fc93acfd9d3ed531
  • SHA512 7d71eb5887ec014b4d11b1a0d0a5f687d6305ff52d7160154db9c1cadfab30a9e55d004d0e3d4ceb3fefdafe61a3924da2ae06d12483a651ddea6b621a489e10
  • SSDEEP 98304:WvOGsjOioeEVvLca87Hsc5jr4z/McrfL/lMHIF2wvjQmp6xnKJnJbLCrxEEzk:l3Ois2X4zDfL/lMe2a90CV2rxs
  • TLSH
    T1A5462326E7AC45BDE1B7B1748C93CD07E33A75082771E98F1768A4AA4F235D04B2E712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2