Extracted

Extracted

• • Target
    [email protected]
  • Size 124KB
  • SHA256 dac7fac1d7d9acc529762965361ec433e0c6543e9d86a2bf0d7ffe8695ac7c75
  • MD5 4d35b06306914d078e05484264d8fa8f
  • SHA1 9028b5b3a740cdd08a8e75f573ec5294c032becf
  • SHA512 47e6c607653fb89d6562707bb9709c910480cf3fb715b6aa16f5f77782a2172a6234187c3a61dac7c8d06c76167f71b5fef3f6efbe79d1df42a2ad54163d9ea3
  • SSDEEP 1536:EstL55ZVs5vK7thTrTJbtsvcyLNF8ZAlymuQ75mUX14eRLdEUxW3DBIYGUHerbqK:EsvIvK7nrTJbtoc2VuQksyep8KYWwO1
  • TLSH
    T152C3C4547BE9511EF2BBCB7CA8B1E1144A76BC132CD1D65D0DD430F90A31B80B992FAA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefaultdefense_evasiondiscoveryexecutionasyncratpersistenceprivilege_escalationratspywareransomware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2