Extracted

• • Target
    install.exe
  • Size 56KB
  • SHA256 80e35d0641ee06b1dec23fa872efced7a49d3e7385e493f5687a1aff703c1525
  • MD5 acec6db3355a875a3a1e0527bf82223c
  • SHA1 93ea1ce53f9585846671a0629c14e8892b328a72
  • SHA512 e6b8c837118a431cf63e7f367b4d2b32ecd66d0834a7739a709cea88a296971757c12052a5cf0c0d8157e9cc4730131b95bedf691f3128d0a0da6ffaa90e7feb
  • SSDEEP 1536:R4dJooh0Wa0aer344Jw/ytUqVS5EkIijQ1fTNM04D:R4dzVTaer344JzthRZijQ1Jj
  • TLSH
    T19143F177867DE9BDC42212B357CD0440FA6F2A3A5AC9173B19606AFFCCDA2E05B40643
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  slumzickdefense_evasiondiscoveryexecutionasyncratpersistenceratupxadwareransomwarespyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2