Extracted

• • Target
    d6be040be4cae58bc333f7aa922cca6249ffdd70b168ba34b7767be650a66ce5
  • Size 5.2MB
  • SHA256 d6be040be4cae58bc333f7aa922cca6249ffdd70b168ba34b7767be650a66ce5
  • MD5 8dfd8613bddfcce31362f61cafe9a453
  • SHA1 cbc0877a4a10be6edbe743a2adfc9916b25ea217
  • SHA512 b9770bb3b7175b2880193a2cca45f162fcd8102d874a49123a8819cfcb7a87076a6ae96f9139114408f3e32e86111eeb85baed549eda9f6dcf8651fabaf2e052
  • SSDEEP 98304:MvOtsjOioeEVvLca87Hsc5jr4z/McrfL/lMHIF2wvjQmp6xnKJnJbLCrxEy+k:DCOis2X4zDfL/lMe2a90CV2rxYk
  • TLSH
    T121462326E6AC45FDE1B7B1748853CD07E33E75082771EA8F1768A4AA4F235D04B2E712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2