Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    AsyncClient.exe
  • Size 95KB
  • SHA256 dfe3bba68ffe9657b7707f7ea9e98b4aeea549f74826fa6955a5f3743a164e13
  • MD5 e45c2ffa71f939ba6c664d1d4fa5c1f0
  • SHA1 61ba8ac2c5f7d54c30d36862f08b3b728b58c22c
  • SHA512 881807f2dc218f9c641d27f0cc74d7fd322e4ab46e7a676328698ff46e31026d209e1664175968165de8251e2fabca0e32c4c57794c51108bc50d0e3a56b2c15
  • SSDEEP 1536:nijoK0C+OYxUg6GcFr59mq7AX1L1ybb1KwiSgW+ZB91d+xXFjzMacxJctvIBx:nijoK0C+JxUTGcR5Eq7Y1ybbXrAbmVji
  • TLSH
    T1A8A308403BFA4225F3BF6FBCADB161454A76B9636922D65D0CA410CE0632781CE92F77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarehackervndiscoveryexecutionasyncratpersistenceratspyware

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3behavioral4