Extracted

• • Target
    de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4.exe
  • Size 866KB
  • SHA256 de8636c5d87d276a4971eab3cbe5d3d3bb18618e8a24ae27b154e1548bd438a4
  • MD5 17d02350b80c3c03c0be2b1acab650d1
  • SHA1 775181f6686d21806ba7e6fe4ae1ecdc82d0157f
  • SHA512 e61b19867eb0aff9d43ab7f13ac73217d0bd244e8b908eb902940315d77c3df67fbde40f7d80d602d8f491065fdb98791deb5f3fd4c122ef010f09616d1aaade
  • SSDEEP 3072:dBUyU7/NUauKvxUjUYqDbf5PBb6Tx3zU5IYUeyUwgUn1UdjgUtGU4rZ/ME+h0UIx:CQdx8nHZtwjWK3FFQgzv1x5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratdefaultpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables embedding command execution via IExecuteCommand COM object

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

  • Detects executables potentially checking for WinJail sandbox window

  • Detects file containing reversed ASEP Autorun registry keys

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2