Extracted

Extracted

• • Target
    69e1e841b2483e450e2a2db56a2ffa6e602e7d369b84f5ef4ad0f7cc390f3505
  • Size 96KB
  • SHA256 69e1e841b2483e450e2a2db56a2ffa6e602e7d369b84f5ef4ad0f7cc390f3505
  • MD5 5f1cf0b24b7dd4e208db47cecc100d01
  • SHA1 952f9c0f57f8a049430004b59cb82021b143ce72
  • SHA512 2342430ad35e5778e65bab7763edb2631506014f1cafb4f0b7e4d52848da46549ec9af3c7992b66854ca75783f694cbe4de0fc99efff146e9e9198ec7b2822f5
  • SSDEEP 1536:X8XdbkWOJp7KQqMMhbBSEdS0/4Dm3DBIYGUHerbqYwiq:X4kWOJp7KdMMhbBnEU3KYWwiq
  • TLSH
    T12AA3F71477E9842EF1BBC77C94B1D1081675AD232DD2E74E1DC430FA0A72B81B952FAA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2