Extracted

• • Target

    7981642e3e60c849153b12c488b7589a07f590781d5b2cf209474fdd370d63a2.exe

  • Size

    365KB

  • MD5

    181069ef56a26e9996d2bdcd7264b103

  • SHA1

    dd56a9675cc074fe2022bd94562e9ddc3e172659

  • SHA256

    7981642e3e60c849153b12c488b7589a07f590781d5b2cf209474fdd370d63a2

  • SHA512

    17d96e01880bb8a361f64502e5f20e80ccc8f41c31ec20d80aa57bbd7ea9bad6bebdf035a6f45ac0efc104cf6f12e47058f83d836b3b9a735e2536114a367e51

  • SSDEEP

    6144:beQ8CfYK6Uqd2GhNPwT2NE6UVKbM0I28VHbWpXqX1vST01i:beQjY3Ui2iNYTQE6UYbMRZbv0yi

  Score

  10^/10

  asyncratdefaultdiscoveryevasionexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2