Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    1.exe
  • Size 95KB
  • SHA256 44cd4f0f963f8f499671a21e747ae653f1e565e2d294ed3af5489dfc2b5c1e0e
  • MD5 8bd4a038e4e63d2a351e713267552871
  • SHA1 f2088190f70550771565e3b934c126bdae8a824b
  • SHA512 e0ea42ee2d3d9405c39ff83906cfce4ed0fe0a0fc320cd7ffa279f7fe86c0b5b1d4cfdada33511d9b0adb354c43520d69ba22d46c4d7a59d30f0ff5762b6fd48
  • SSDEEP 1536:bjoK0Ceqdqsec9OPklU+z1ybH1zwiSgWOZB91plgc8lqJU1vIdx:bjoK0CeqdqJc9QkVz1ybH2rUbw0K4x
  • TLSH
    T1B0A3F9403BF94125F3FF6BBCAEB161458935F9676912DA5D08A410CE0632781CE92F7B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarehackervndiscoveryexecutionasyncratpersistenceratspyware

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3behavioral4