Extracted

• • Target

    532ca15e5fed6774cc1a5fbbf96a814bccea78aa064b9bdee20fdb174dcfdd2f

  • Size

    268KB

  • MD5

    3f7f9bf3eed6507723017d39c52151ce

  • SHA1

    7118eb8912e013652561e698b16531753cf4550d

  • SHA256

    532ca15e5fed6774cc1a5fbbf96a814bccea78aa064b9bdee20fdb174dcfdd2f

  • SHA512

    e686f70b690f22d0581e8dc206ea7040c2ebc42dc7b952e198c76f511fffb9b27db8d9f62143de6bb8ce49832f12d47178c7a547e4a0c7f17699b79e30e53078

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8D4:WFzDqa86hV6uRRqX1evPlwAEQ4

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2