Extracted

Extracted

• • Target
    fc8cbd61c13b628b362e4ec64f1b4a6398461be5a2d95d97db2359fca8975df7.bin
  • Size 784KB
  • SHA256 fc8cbd61c13b628b362e4ec64f1b4a6398461be5a2d95d97db2359fca8975df7
  • MD5 798d5126398baa963c07b88bbc441565
  • SHA1 bb0939045b65cab0bdfaa075da3e6a79313714e1
  • SHA512 05312b65c0c5b0f07b955c6f626b7581d2c2f08aa1510f62bee9f875e2202415f4b06e6d22a466b99bda68da6709ab1e2cbb236ce288496557b1c6df8f63356d
  • SSDEEP 1536:ylfIcXARS8U1aKQ2Fgt8xqoPjXtjXFuvcVQWWKu:ifIq7TaKQ2WGzPjXFXsvcVrWH
  • TLSH
    T1720592526BE8CD120160DD48582D4603EAF11A3E114D7CFCF92FA8C5EF2F98765ADE1A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  saynomorediscoveryexecutionasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2