Extracted

• • Target

    1c30611e8e3a99301ffe1102d4f70c44fd2d7593878dcdf4178002777fe6e920.exe

  • Size

    12KB

  • MD5

    18208ba6920a74e8ca7bd244571ae383

  • SHA1

    61797d94d14935a588a799e8dc943355eb6f4022

  • SHA256

    1c30611e8e3a99301ffe1102d4f70c44fd2d7593878dcdf4178002777fe6e920

  • SHA512

    87fdb3de8301e8f2dd7b8601ee468e64387ce72616af21153d129f236bf28a6dd81e1ba905cd534281bdc94aca1d85898ec6e64170cab2bb58d3c608002f64f3

  • SSDEEP

    192:4Qt7If16ODCvuuYT6DI6kDmBwqVT9N62uEiGe5PF:A16O5CDIJDawqrklEiP5P

  Score

  10^/10

  discoverypersistenceasyncratdefaultexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2