Extracted

• • Target

    60c5753499a5e98229955174e4afbc0ed7c948692edfa864cb75669037f608a0

  • Size

    9.5MB

  • MD5

    ddc8d49e477960bc7601809021f33738

  • SHA1

    f3cd85a1934d4818c3c88b0314957b1e2304e264

  • SHA256

    60c5753499a5e98229955174e4afbc0ed7c948692edfa864cb75669037f608a0

  • SHA512

    a6b73d8f3eabc4e855de927257075510c593d52d59efc121bc21d8034c57ba0251e8453c4d995cd156aea7aa69bee8ee4ccfd2091591a6c328eecd85d2bcf955

  • SSDEEP

    49152:4hVHBlu5tvVvYlOJ0rUKrwPlt716X/hFiZPixVUg148GwjQJKGPt6:4hjC

  Score

  10^/10

  asyncratlocalhosttool'sdiscoveryevasionexecutionratdefense_evasionpersistence

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies security service

    evasion

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2