Extracted

Extracted

• • Target
    2299344bbd62b4e35352914b243585d4472686167239dfd3362d373880c34507.bin
  • Size 1.4MB
  • SHA256 2299344bbd62b4e35352914b243585d4472686167239dfd3362d373880c34507
  • MD5 55e75eb00e0ffa0a4f819f1ed3753ebd
  • SHA1 d711744826b02caa5da2219001700f8a953b8e31
  • SHA512 e6e4d6772e903dc78853a5180e9a8d241b00acd77bd8048e02194ee40b51172c74012be98c67d2b78dc3c0a3f5fd582f0f45a1f669fd67c9c84162eb5aa91a58
  • SSDEEP 6144:0c90h/iN8QvY1LgYoQSCpAi8SQxzpdKrsjOWIWhLDpf:0cWhgRLDpf
  • TLSH
    T15465E8E24441020A8879311BBB2D5B1F7BDC6BF1A6E4DF43B66AF8F0155C466E6C93E0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xxxxxxxxxxxxxxxxxxxxxdiscoveryexecutionasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2