Extracted

• • Target
    062585f31b7c3bb580674b4d6b78dc508a39ef0a37c257075246df8635ea67ca
  • Size 45KB
  • SHA256 062585f31b7c3bb580674b4d6b78dc508a39ef0a37c257075246df8635ea67ca
  • MD5 c2e6702e375baa1460f617aa3696da14
  • SHA1 678911ea4c455c78bab8dda467e307f4266b15a6
  • SHA512 ad2aa2d2d9b3410791e6522a3bfcb05a06fb820ae20f873755ffb57814963f1e1ccd39f7c7627dc0095e2056b09a8fb1635e4a9ac0984196840807a3ccd62900
  • SSDEEP 768:Nunn5TgoqzqWU8d9rmo2qrcOjPGagAWOzjbFgX3iG9Zpxbh2UHtm5cDZLf+:Nunn5TgNR2dOTKTO3bCXSCHdQKjdLf+
  • TLSH
    T12E232C007BE9822BF2BE4F7898F25145467AF2A33603D5491CC451DB5A13FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefaultdefense_evasiondiscoveryasyncratinstallerpersistenceratspyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Probable phishing domain

  behavioral1