Extracted

• • Target
    a530327db0cb5c7da8f26b66b487e130e72bdefdc437fc2a447d690b5612d3ea.bin
  • Size 36.8MB
  • SHA256 a530327db0cb5c7da8f26b66b487e130e72bdefdc437fc2a447d690b5612d3ea
  • MD5 4f53e55c9f3cfe1105b118ecf390b95c
  • SHA1 99a3564a7ade03b2fb42a684dd3ee1cd31e8760e
  • SHA512 d75eda725045f38259844055c166b6a112b3735e88ecb07ed8fd476cf4613fbbb7b504175512e9274340ecea3b2fbcbbc5438ff96c7051695af5a98896ad1faa
  • SSDEEP 3072:g/QcAhVvgLzc3OZxnaRroo027LcCc4cJcMYz+d4kcCX1ZlBpXcYctnAVU6bKGc99:JT+e
  • TLSH
    T1BF875DC49F8025FD6B0FB9311056E9ECE23A2B65D25219151A8CBE94EFD31DD0F09BAC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  2026discoveryexecutionasyncratrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2