Extracted

Extracted

• • Target
    may thang report ngu.exe
  • Size 90KB
  • SHA256 5c2cd0a4ce8a21673021969649a1b597ed8264251cc6c22c0208f5b00bbc6d86
  • MD5 3794e4942c4db134d230b2f91e0ebe55
  • SHA1 2084996b663ebd9c3b9f6cfd8fb03dfa2f400900
  • SHA512 a4e33b4cbacc128136fbc96646c6e3c85500addadec79670de0d57445165859393a1bd59456e33cccc08416a01b1394d2d9266238d4a107ea22f83f8fa4e2a68
  • SSDEEP 1536:wxtLZxKyBnfIXSgVJbBFuvcyLNFPZAlym+nAQas5GcRLdEUqx:wx4yBFgVJbBMcNV+Es5rpax
  • TLSH
    T1E793F8443BFD4116F2BF5FBDADB16104497AB9636811DB5C1CA420CE0A32FC19992BBB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefaultdiscoveryexecutionasyncratpersistenceprivilege_escalationratspyware

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2