Extracted

• • Target

    a8a72cccb4eab0b9ee84f1a9ff5cda234eae5c182c0d138c4e6938fdf30e397f.exe

  • Size

    270KB

  • MD5

    648561eb56761122d8ad1121637dec68

  • SHA1

    2fb61de18ffb3e0f5410ed1f497ca5d2528d150b

  • SHA256

    a8a72cccb4eab0b9ee84f1a9ff5cda234eae5c182c0d138c4e6938fdf30e397f

  • SHA512

    aad58d748208cdb1d7f6c2c884a1dd93b13d6715f3047678b3daf97054ae3d6939a1585f3b80f738be6df2c8c429bd8a6307432636046ab8715d536dcdedf6d4

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sdm:WFzDqa86hV6uRRqX1evPlwAEdm

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2