Extracted

• • Target

    SecuriteInfo.com.Win32.MalwareX-gen.15686.13544.exe

  • Size

    617KB

  • MD5

    efab5b5f812d86463330da19684fd844

  • SHA1

    a0b6bac84f4de1b67c41f6341becb3dc2626db6b

  • SHA256

    08d86feee2707af5c57b4ffa8663c0e447c7425c39a103906cf15eae7cf1df9d

  • SHA512

    519f70b3d728ded49ec8bd8e51be4f33a927b3bd8fe6b497352da01db90004e1f42835a279ec81820423a76cc6bec173ac6dbd30739c30f59fb944d75f84fe84

  • SSDEEP

    6144:hnyPsDRaXbsXEWqoQ232cl+ZAi/Q4EyJHNtp1oMTjBEDFOq68Md0E+ah73obmbz/:L3TmyiQgJH5+u2FOqRfSDOraw5vqJP

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2