Extracted

• • Target

    7a546b23227b6b2c2f70325b1c5e9207394b42c74e88a8f977edbb60e2c3a881

  • Size

    41KB

  • MD5

    a3c10831383854f41845e80b3926d60a

  • SHA1

    05526d00bc628eb34fa153ad8bf23391c7b1d272

  • SHA256

    7a546b23227b6b2c2f70325b1c5e9207394b42c74e88a8f977edbb60e2c3a881

  • SHA512

    11e05f665ef6e9e855e83d36fd708a6dc7a2b6a6926a1d1fd0e96bbddf67b1c9427c8f899b8a60b6bc7157d37707f6632a65f8198597a388ff150f0033c0860e

  • SSDEEP

    768:I6F3VHDlvYnuU9c7q6e3tr53BFo2rAbvZ2Eore:TnlwDc7c5F8h2i

  Score

  10^/10

  defense_evasionexecutionasyncratallahsizdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2