Extracted

• • Target

    113ed17fc6dff4197896f75a26ec2548d2f955f8062e8e02301f76fd338612e8

  • Size

    267KB

  • MD5

    a4659dc2157ed87d0f1e6efb8e2fdbf7

  • SHA1

    f7efacf8ada06e71fffa497009cd0b790e61d33b

  • SHA256

    113ed17fc6dff4197896f75a26ec2548d2f955f8062e8e02301f76fd338612e8

  • SHA512

    f0d7c63b1130f21b051d34fe03d36e30c2acccf21446559581fbdb18a24901d83d26dd2248ddeb24eef10d91da31d440d8c6a7b0926c10926fa9282c79e13e62

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sdC:WFzDqa86hV6uRRqX1evPlwAEdC

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2