Extracted

• • Target
    c4e8547c04a8c395af60d7f005c6702482d897e02d2d71b64387466b6474bb0f
  • Size 5.2MB
  • SHA256 c4e8547c04a8c395af60d7f005c6702482d897e02d2d71b64387466b6474bb0f
  • MD5 10356274f35fc919623e297872ee7ebb
  • SHA1 53ec5c3666844034733b58b13eda8bfc9a6467f2
  • SHA512 e79712452bd2ad55fa292bc5840b3164e1804f2c5f7dcf3b8e2132a232ae487986fd1af856cd9510ee84e1acf8928dc6b0e97806ccb983ff5226127d23934682
  • SSDEEP 98304:zvOesLOioeEVvLca87Hsc5jr4z/McrfL/lMHIF2wvjQmp6xnKJnJbLCrxE/q:CXOis2X4zDfL/lMe2a90CV2rxv
  • TLSH
    T1FB462322D7AC45BDE5B7B1748853CD07E33E75082771EA8F1768A4AA4F235D04B2E722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2