Extracted

• • Target
    f54347c4fe41286963238ac74da32331d76ff77088907f2cdc2c7f0980eb9074
  • Size 3.0MB
  • SHA256 f54347c4fe41286963238ac74da32331d76ff77088907f2cdc2c7f0980eb9074
  • MD5 700462eee2a290595ca95dcf16223fcd
  • SHA1 15daae65d0bd8185a6a5a282e72eb8465d1cc974
  • SHA512 59891bc93a2e1b951a1f4b290c61a4f082bc53991c96c412d01e08e2ce09a13b46d4cc8f3dc1e28069a81b6d682f520fbc620d03f4ba34ca2be4abd2f0b904ca
  • SSDEEP 49152:zjnvDCJz5CkjOfrHPSYGin/0TXOZwEBteYoMK76QhrTeryxwbn4IyeWp7msTYYEf:zjrqzVErIinMjOZzsDT0LntNFmdEa5Jc
  • TLSH
    T101E523355AB5CA41E51FB739C06395F4882BDE22CE0293CF78197E1A32726E8F431676
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefaultdefense_evasiondiscoveryexecutionasyncratpersistenceprivilege_escalationratspywaretrojanupx

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2