Extracted

• • Target

    FutureClient Installer.exe

  • Size

    513.0MB

  • MD5

    1bc454831d43186b177650744ee816ef

  • SHA1

    ea81e70af830fd270617db0a260b0efca6e71394

  • SHA256

    0d4daba50682885610e2d07d133532e78eb18ba7b7b2deb6a685230019a6d611

  • SHA512

    d0819a56e399c50ed3f062b7be9f195c2eadd40988b7127b1a106c3ec8102e3de231edb3efdc68eeb8f59fd080667db9d317fb72762e84b19efc3c5825a16f30

  • SSDEEP

    98304:U6vhXimZzuDhfThmDJ02+aHJfZRpiGCgcs6vhXimZzuDhfThmDJ02+aHJfZRpiGY:U6aQJ3+aHhZRXCgz6aQJ3+aHhZRXCg

  Score

  10^/10

  asyncratfuture gdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1