Extracted

• • Target

    Client.exe

  • Size

    265KB

  • MD5

    73503a6b7502669d3937c8406cf97d22

  • SHA1

    dc9426f95a5b53cfe949f051ec96aca42775c97e

  • SHA256

    96cea5aa04bf16efa6f0c768643013fe621e1efd5e17180e1c4d26bba2c60823

  • SHA512

    2314a6972f3d268fd5a9209c5fa6484e0dfb2af07154060ca54c157ef345b27a5c279c9f15d5bec25292f5908e65f250533dcf4b3261f7b7acf0946fc7feb56d

  • SSDEEP

    3072:vviJueXGbbXBGmAtPBKCQCeLhiGGGGGGGGGGGGGGGGGGGGGGGG9YGGGnGGGGGGGV:y/XkbwHPBKCQC6hUvoJ2zG+MQ4

  Score

  10^/10

  asyncratwindows defenderevasionexecutionransomwarerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1