Extracted

• • Target

    43ee27bab0d8542ef584be11117b6610N.exe

  • Size

    267KB

  • MD5

    43ee27bab0d8542ef584be11117b6610

  • SHA1

    88c79b63dd9c476fe0e727656b4679dc38d63df4

  • SHA256

    9db2883bad55629e11c0c328e06a1da16278997c67217f4182c2a763aa306d41

  • SHA512

    167e02f8c5e97cc9b8b5f0608ae82a69c84b943d066f5a913a91689a9b08009931229b4667a9ee3c412effbf4c7eb8762ff4b6ffb8c882cb7004cf37bd64fe51

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/w:WFzDqa86hV6uRRqX1evPlwAo

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2