Extracted

• • Target

    Client.exe

  • Size

    47KB

  • MD5

    fb11528a2333082ba221031b9a9a0e77

  • SHA1

    af59136079fc620db3ff50f0a00cc4768bc05336

  • SHA256

    b2c58a9b825b968a5e48ee6942c45fd44b88597248e5b4528c72ce9b9baca9f5

  • SHA512

    344d4638da6abc45286c32dcd53856e3e3c1ec856a3a2fe57f1140d5475cd6f6e836bf651d152abdef67a0f8e65647e985512f8f6630f9b47a1e47513269d10b

  • SSDEEP

    768:4q+s3pUtDILNCCa+DiptelDSN+iV08YbygeB5gyZaUhvEgK/JvZVc6KN:4q+AGtQOptKDs4zb1BynkJvZVclN

  Score

  10^/10

  asyncratdefaultratransomware

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Renames multiple (4490) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  behavioral1behavioral2