Overview

overview

10

Static

static

3

3e5764856a...10.exe

windows7-x64

10

3e5764856a...10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e5764856a708b6a85c4dd9d38e2ce10.exe

  • Size

    266KB

  • Sample

    240706-enpz4sxgkd

  • MD5

    3e5764856a708b6a85c4dd9d38e2ce10

  • SHA1

    3a978fbd18995c739016622d40d84747a44ebd7b

  • SHA256

    4d162811c19727e0314675da52b4eb32c0f2edc13436e38c1651395baed70296

  • SHA512

    26b547b3bfc05465d842c6bc2c343eac53de80b869ae7a495c4afb78d326f1ca9021fefe174e1492d727f9b3da0b0133e26bc9d9ea976753a9fcf200dbf698ce

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/t:WFzDqa86hV6uRRqX1evPlwAV

Score
10/10
asyncratpersistencerat

Malware Config

Targets

    • Target

      3e5764856a708b6a85c4dd9d38e2ce10.exe

    • Size

      266KB

    • MD5

      3e5764856a708b6a85c4dd9d38e2ce10

    • SHA1

      3a978fbd18995c739016622d40d84747a44ebd7b

    • SHA256

      4d162811c19727e0314675da52b4eb32c0f2edc13436e38c1651395baed70296

    • SHA512

      26b547b3bfc05465d842c6bc2c343eac53de80b869ae7a495c4afb78d326f1ca9021fefe174e1492d727f9b3da0b0133e26bc9d9ea976753a9fcf200dbf698ce

    • SSDEEP

      3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/t:WFzDqa86hV6uRRqX1evPlwAV

    Score
    10/10
    asyncratpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks