Extracted

• • Target

    4ff903deb13375705b4beb2d30fe494fdca733a42efee484d7380773e9d24750N

  • Size

    268KB

  • MD5

    b7e6d9e4bf0e64884edfaa470bab7160

  • SHA1

    47ec237e66cf527a53ce78d24ab68c00f204be1b

  • SHA256

    4ff903deb13375705b4beb2d30fe494fdca733a42efee484d7380773e9d24750

  • SHA512

    9cbe3ad1ad8069ae85e91ae9c9cb38470eb9e596bbe16fb12ca5e7ad773b4688b01e1459983da4d94bf544fb4f644465a40eabebacf534e681bb40a4ccd56525

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8Dj:WFzDqa86hV6uRRqX1evPlwAEQj

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2