Extracted

• • Target

    softcore-shd-lavacrypt.exe.1

  • Size

    408KB

  • MD5

    f1de359b4cb3e98d01e03f7f4aff75d7

  • SHA1

    ff190e4a989695c64f95495c0347498ec11eabd7

  • SHA256

    095a10fc0b992d28fd110516164eb608316a7d2bded28a2e0bd7aa66e895197c

  • SHA512

    21fe1331649696cf61fcae8054b7660803e73881302d975a0767422d7af3426bd559de17add4a00eaeaa43500c9a5b87a0012afeee8a80b273e23e1ad7315400

  • SSDEEP

    12288:8Jxyctbiy/9SgCf7iSdo1pkQLBB55De61:8Ty9y/4gCf7Qp5BBbq8

  Score

  10^/10

  asyncratspreadevasionpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2