Extracted

• • Target

    ae55dc186e2373b964f1d84fd51aa7692fdb2994cc163128b97631c3ba7f7066

  • Size

    680KB

  • MD5

    47e6542e234e5ffed88732519f19008c

  • SHA1

    b3dd01bf81d5b4b9595c13032d0fc8006dbc7e64

  • SHA256

    ae55dc186e2373b964f1d84fd51aa7692fdb2994cc163128b97631c3ba7f7066

  • SHA512

    98e4ddd035c81623ba2dcc5fc4ca58da3aa6ba10c7bce25ab0a00e7737c11152d6a77507c859f7f369be8fc456189acb5fe90a55064a5bf790e06662f3b589ce

  • SSDEEP

    12288:+Xplx92r2O9Ycny57ohEDGtnXCkgybsySO+TbQnpNwMfgriFg3ikzA6pVPbi81kR:oFTCy5XityUWXUNwMfgrV3ikz8

  Score

  10^/10

  asyncratdefaultexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2