Extracted

• • Target
    @MECHATEK_۳۰ کد ChatGPT_pdf.exe
  • Size 8.1MB
  • SHA256 aa7fa2b65c40f0feb3453bcf872dc6992227f7524e6082ecf55ab1e3ab22dc5b
  • MD5 9480f23df47bda4dcac8a0a4485a704d
  • SHA1 232f3dfa9a9c3b49d68c5a5f2a89ab5e7c6aaea4
  • SHA512 0f868d32d54073be87525b8db4363f14e5c14122bb985b240d4e7b7b18d8243ce94a824407dc2a65b34c33f805db31a720f7cfb0b0b095632862413a7e13cf36
  • SSDEEP 196608:8M+04boqh+04boqlOis2X4zDfL/lMe2a90CV2rxVx:8MO8qhO8qIis2X+KebUrxb
  • TLSH
    T16C863356D77D85BCE4F3B2708C47CE03D37A74445BA1A5CF536864AA8F139A00E2E72A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aaexecutionasyncratdonutloaderloaderpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2