Extracted

• • Target

    APROBACION DE PAGO REALIZADO EXITOSAMENTE.exe

  • Size

    8.9MB

  • MD5

    705385c167486ac75a5063f6934c5631

  • SHA1

    d08da29cca536b6b502cec7ca2f5c9cb419308e2

  • SHA256

    558af040bcfa1aaf774e953cca682eaaf38ec8c4f3ca4f3e24e0ea8a783ca1df

  • SHA512

    67249411406d7a6f41a97a6e40facd364fb6777c2833465aacdc6081fde3854109c9a308f5dc6f03c6fd940cc2d291be7ce9b13c6dc5a45dc810d091e98d88af

  • SSDEEP

    98304:7soxgg0Y8w5AUY52JgpVOEjrZGNw9J2/8w1MlpYRO1izoaRIS9NhICGucHATgwY0:p8Aohi8Y/+y

  Score

  10^/10

  asyncratdefaultevasionpersistencerattrojangooglephishing

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat

  • Detected google phishing page

    phishinggoogle

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2