Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    test.exe
  • Size 95KB
  • SHA256 92ed7e13c812fc9d6fa885f8fa936296f7eb2981ffb1f4245325e64efdd24e2b
  • MD5 330c7d443846107eac029028a67c3f95
  • SHA1 e313483feb7700939bb24ab073790bc92007cddf
  • SHA512 0c190cc018fbc9217f44ee92a01d6de57f4ea379d1fdac7173e7b9ad75251ef07fdd88079a23f7cf018b29a17d7bd52bede7f7b1f4ba2dd86b3b9041f0797d27
  • SSDEEP 1536:9joK0CgPZuybaK9Gjasl96i/1ybQ1xwiSgWUZB91dRfCzeJU1vIXx:9joK0CgPZuybaK9Gjas1ybQkrCbXeeKg
  • TLSH
    T1C093F8403BFA4115F3BF9FBCAEB161458936F9636912DA5D08A411CE0632B81CE92F77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarehackervndiscoveryexecutionasyncratpersistenceratspyware

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3behavioral4