Extracted

• • Target

    Client.exe

  • Size

    63KB

  • MD5

    a8515eaaad39b50757b65dacd5c17042

  • SHA1

    98bf1b3765448f24447bdcd4117e972fae8fe09e

  • SHA256

    f22ec9c2df8efd42827f0c23c3a47c5cd776e2213cad5f1e067c4f2e4ac0cebe

  • SHA512

    d35bc0179ef0a94fbe579fc4c2991a5a8e720eea2fc70d50a731d37b3934bc90214239339840fcfd82553d08ba54d22dc56d182902cead6d8a2692065a3cd667

  • SSDEEP

    1536:QhW5hc1kw0kV7eeiIVrGbbXw5o6zUKGODpqKmY7:QhW5hc1kWVieXGbbX76w0gz

  Score

  10^/10

  asyncratvenom clientsdiscoveryevasionexecutionpersistenceprivilege_escalationratspywarestealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • UAC bypass

    evasiontrojan

  • Async RAT payload

    rat

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks whether UAC is enabled

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Enumerates processes with tasklist

    discovery
  behavioral1