Extracted

• • Target

    b30b417e0fdcb5a16bbc82304160abdbafe7736a5abce982bf327c49a8be162f

  • Size

    270KB

  • MD5

    e953cebbbeb7b97fac55a22a3446f25c

  • SHA1

    37cb5ff6be0b7515c77ac12b4dddb8ffac6a9ad5

  • SHA256

    b30b417e0fdcb5a16bbc82304160abdbafe7736a5abce982bf327c49a8be162f

  • SHA512

    5cabbe976bd3cb270b8769d7071a17a4ea6e3d5f3f383456509a5b65ecac7a59cfd80b39350b626c84eadd91303167d1b23aa06e72d00756ea290fc6473fa99d

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sdH:WFzDqa86hV6uRRqX1evPlwAEdH

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2