Extracted

• • Target

    ORMANDO.EXE

  • Size

    63KB

  • MD5

    e9fb5039869aa9107c1e78a407de119c

  • SHA1

    77d90fdf13a15fdd185046f59f164d669bf8607e

  • SHA256

    042d9c30c1354763e65ed3c7b7d343bd11d0e00da4a5032ffbb7bff5791722da

  • SHA512

    c6b17396df636296c5b44197b294f62040682e60ba6cae9d331fd3bacb15411f47da9b5c7c8656a242d8ded9d5e872fae146b5ff4c0260f970734b9381cda464

  • SSDEEP

    1536:YhIBLTM3Ufc0cMdQePVivSMbbSwEhdZhG+DpqKmY7:YhIBLTM3Ufc6dBXMbbSnrgz

  Score

  10^/10

  asyncratvenom clientsransomwareratevasiontrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2