Extracted

• • Target
    64d041ec7f0f29dec8a8fd7d8d2c4e0f280177110999f45494c04565a91ee995.bin
  • Size 7.7MB
  • SHA256 64d041ec7f0f29dec8a8fd7d8d2c4e0f280177110999f45494c04565a91ee995
  • MD5 5af025f812e3099c17884c5c27619254
  • SHA1 973e464d912375b030925e5855cc89f4595cb975
  • SHA512 a479dde6664d259eeceb9636f43e3402c691540d4e911c820a06d9ceb5eab21094b3206755006c5d8213662ee013dde78893ee77c829fdc0ad7325cd5bb24586
  • SSDEEP 196608:4gZ8bIXP9XuLvkpyOsGyGGMg3lQaaSkV4NkLa:NZ7XpuLIsZGVZ4aO
  • TLSH
    T1778633C0D1EB86C5C569C83B2BBC4286C93ADFA2AB09C7934D5E6587367534F42AF314
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceprivilege_escalationpyinstallerrat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2