Extracted

• • Target

    ngrclub-protected.exe

  • Size

    3.0MB

  • MD5

    209ce82914f67632c011132bc09a1584

  • SHA1

    eb565f108a63b3f78ea3cefbaec1d845663c671f

  • SHA256

    d3a452c7dd9039acac94b60bec2c90d3bb656756ae7e18a50b328d6fe22e80cf

  • SHA512

    fa47be79234d6805ce37a37cfe1bbf2792dba42ed60914d7b8fc9905bd59b0e483bbadf0a8abcffab07885eb6ea5dfa4d2271fb24fc8099d268b0549f701be87

  • SSDEEP

    49152:LdWnZHdTB1mIkDa1lS5x4hxQJxG9d213ChYfKMjObIOZc/HyVSUwTPGlOVZNB2zg:LdWZHZB1UenSooxGf2CGfKYOvm/SVcjX

  Score

  10^/10

  asyncratversace.wtfevasionratthemidatrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Blocklisted process makes network request

  • Stops running service(s)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1