Extracted

• • Target
    7a9233703ddd6a4afec704729cf1efa88950a2957891ca0131282d7f29ae44b4.bin
  • Size 5.2MB
  • SHA256 7a9233703ddd6a4afec704729cf1efa88950a2957891ca0131282d7f29ae44b4
  • MD5 ab7eb838a5f55e0dd8a0aff4f9fda32f
  • SHA1 1770d1c0d7fc187322847a63e56a635c21f795ec
  • SHA512 05233ed473f796df34dddcba629c302417bcf6affe4e76ed90321f879dd07f3e9a1b7734d4b978bc9388cc04fe082b39318ae7e1879fdfc66f0595af784703de
  • SSDEEP 98304:gvO1sMOioeEVvLca87Hsc5jr4z/McrfL/lMHIF2wvjQmp6xnKJnJbLCrxEYql:HROis2X4zDfL/lMe2a90CV2rxC
  • TLSH
    T114462322DBAC05BDE5B7B1748C57CD07E33A750827B1EA8F176864AA4F235D04B2E712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2