Extracted

• • Target

    2024-05-24_190ea8056a4b0d8af79cd7fc18e0261a_megazord

  • Size

    2.9MB

  • MD5

    190ea8056a4b0d8af79cd7fc18e0261a

  • SHA1

    f78df6968942e2ee33609919c77bca012b3981f6

  • SHA256

    ab1acf6f80a0be5966252c95f03116b4496c10bad6cd260b13b9006dac5886be

  • SHA512

    267106698966317f767b27808a55e2eeb371f977ab85d67537da33743c5b1892c5b422994fd5a210c411bf9bec8849b16f76253dddd936e626fd2bfbd900ac68

  • SSDEEP

    24576:8RoBHi3buy4toE1jC6Ayo2xhWLbSPlqRvc68XzRVGvNB5VA0UC1dUUKj/SZ8j3g5:+oKmo4jC6TovnRUC1doj/Hg4C04pi+

  Score

  10^/10

  executionpersistenceasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing the string DcRatBy

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2