Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    22.exe
  • Size 113KB
  • SHA256 35f19a1a3a4cb11821b9234c46a17631e7e282491055ec87b76bfcb0b16b130f
  • MD5 99b3b9d6f492e915d6669308421f7244
  • SHA1 a455e49245b1967a57dc7c86e2d6bae93a4ccd87
  • SHA512 bda86bec4593afb13d7736bd8d924155a9d95e77ff32bf1da2ae21a7676497c0e6ead97e37358dc3077e8b81fcdb57aeac3e84ea5d56605f1cb3b9d90e582a18
  • SSDEEP 3072:djoK06sEtJyY8CrK5y+Nn+VYQbMCruSbptk4DD:djoK06sP5yc+VYQbbbG4v
  • TLSH
    T1E2B3C4443BF94115F2FBAF7CADB5624549BEBD636912DA9D08B0108E0532B81C9E1F3B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareqh88 botnetdefense_evasiondiscoveryexecutionasyncratpersistenceratspyware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery
  behavioral1behavioral2behavioral3behavioral4