Extracted

• • Target
    9fb373763749bba2e75ae24423a2464ea0fb4bb178b8d1ace65e1d06973783ff
  • Size 5.2MB
  • SHA256 9fb373763749bba2e75ae24423a2464ea0fb4bb178b8d1ace65e1d06973783ff
  • MD5 8c8c089254cab87edce4e078ebd00549
  • SHA1 57c1b0504c0cb5d16c0526186a4dc2de889f32c8
  • SHA512 7e6cf3daab500a574b700641dfccc988eed0dc7b3691d5de4c9799d34bebd318213d0cd6f2811d4f5c8431b115aa5df73a7ded44e5519d62b404512066a8b264
  • SSDEEP 98304:1vO2skOioeEVvLca87Hsc5jr4z/McrfL/lMHIF2wvjQmp6xnKJnJbLCrxEWg5:sQOis2X4zDfL/lMe2a90CV2rx5A
  • TLSH
    T11C462322E7AC45BDE5B7B1748C53CD07E33A75082771E98F1768A4AA4F235D04B2E712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2