Extracted

Extracted

• • Target

    d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd.exe

  • Size

    5.5MB

  • MD5

    9b4a2d9750aaa1b533ff618300d60d2f

  • SHA1

    a205bceff0efe3141810a14fbf4b850355165b92

  • SHA256

    d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd

  • SHA512

    665952e14d1f15d334282aefa7c4b4562bb27d5cb43a86f31c03bb9bbc27d470562aff1d1f7ff800fd6e7cde7e5a160ef9b0da95e69ca62d0909a43a013b9d0e

  • SSDEEP

    98304://vsROSfBa8P9LuKpjO/bmZ4CPVdErgPgPvO63wGxVoz7XJfNCZsD5CR4+xbj://vsX3V1p6bmyCPLCeCwGxILJfNCZsD6

  Score

  10^/10

  asyncratlatentbotvenom clientsevasionratthemidatrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2