Extracted

• • Target

    ad2315d49459ab240df61af4f6e336f310c470ec33f8bec1cb8d4fb16b48ae9d

  • Size

    426KB

  • MD5

    eafad63994d7226e68bb54d7a9396e91

  • SHA1

    acc49ad9a05403be2079f48954a397251a5b124b

  • SHA256

    ad2315d49459ab240df61af4f6e336f310c470ec33f8bec1cb8d4fb16b48ae9d

  • SHA512

    6d8181c1229a47333114c9b0e1ee2f333301bc3e774b9d7ecee8d5ae87751bd605508f9fd4ce77a20673996bcb9dc2ccc70f62e837fe0089bdc0478a4d301f4b

  • SSDEEP

    3072:bAa0zeTpio4F+B1MFnMUE2XAVLis8sIQaaBbnkuKMdcKQsd7WyxM1J0C1HzKyL:lTpq+w1MzaAVJ51LKMjpWy2J0oKyL

  Score

  10^/10

  discoveryasyncratusa onlycredential_accessexecutionpersistenceratstealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2