Extracted

• • Target

    57875.exe

  • Size

    350KB

  • MD5

    5616b95c1b71f2a56742274bec64cfc3

  • SHA1

    1b092dbe0a5c797f89d52d853dc4f23a7d0dc87c

  • SHA256

    6d4d71c94b1613f2bce90d54971e115c33fc57f3d78965cf219754c9393d263b

  • SHA512

    86b92910f06320ae2500690a96111cc25a965858c6b86b5b649f884d43f942c0923a3ac35f694685ce75bb52fdd1c262dfa7058a8e7d059da4aa6be3aa3db93b

  • SSDEEP

    6144:FjfgX5fZLs1RIu4FsFp7GUb8x9mTnQGo7Q7k91LQqWPzTg3:5YXhZLsyFMQUb8IQ/7R1UqWPzTg3

  Score

  10^/10

  asyncratdefaultevasionpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Async RAT payload

    rat

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2