Extracted

• • Target
    b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.bin
  • Size 210KB
  • SHA256 b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d
  • MD5 5d8421027847620b57234b959ea986f9
  • SHA1 3b081b5a078fd6f948b769eb0bedd5c9217e8f8d
  • SHA512 d132e28bbd814c5b4132a86a0a65d8791f417e7b4a1e63154369aca97b985b83977830f6e93cbd9f0b3619c984a7666ee00031ceccd96321e611082ae2bc01c4
  • SSDEEP 3072:aFB+/0KRDKDb21OF8WxnZESKWI/9fGRUGKXs+S++7KFSbxeY+qDDrM:aFB+/0KNKDb22lnZEVv9XGqStKEbxI
  • TLSH
    T109249E2D5E8AF89BD41419B55C77EAD10A6CEF99F0A1169834F8FF3CB7928708610F90
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasionexecutionasyncratdonutloaderloaderpersistencerat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2