Extracted

• • Target

    fuck triage.exe

  • Size

    63KB

  • MD5

    ecc1a6d24ab60e9544616a5ad925d1ef

  • SHA1

    4ce8ba32d84fe862264926efb49d031561c86729

  • SHA256

    57788c4dea47651247787df503d94a022acd05003dc02b3575ffd80ccfc9a9b6

  • SHA512

    56c6d225b7af0fc17fdc233efe9d2c08cba3e44a9020ee9d39ffe84bb688683ad3dfe6b9439bb6abba09449ec691cd314b78ae390140d8cec06e91e0eab00bab

  • SSDEEP

    768:ym0vnfEXf78awC8A+XUlJ5EY9Vmkn1+T47SBGumDbDSph0oXj93pugsSu8dpqKYC:aEXi29gdUb0h9jHuOu8dpqKmY7

  Score

  10^/10

  asyncratdefaultdiscoveryevasionexecutionpersistenceransomwarerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Executes dropped EXE

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Modifies WinLogon

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1