Extracted

• • Target

    2024-08-06_8ca8d1fe960a2b10d28ba017a8e71e10_hiddentear

  • Size

    592KB

  • MD5

    8ca8d1fe960a2b10d28ba017a8e71e10

  • SHA1

    2157e3dff5041988706756723655d5501ae8148f

  • SHA256

    566faf9961e590ce146c85c70fc08191682a20166d852ace3a269c418135cfb4

  • SHA512

    475ce76b2ed0ca3d2284fb9e3cc4ae4aad0b7e9eba21bf615dd1f23bf6d3d150e472dee430884d2243e6b02509c46b2c5c796122aba076f828015c050df6eccd

  • SSDEEP

    12288:qpFbY22u8RFARyGfQ3MWTZfV/hlBg1ddAAZkR:qpxY2CkyGob9/lkAp

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2