Extracted

• • Target

    52a610b0ad89165f4a65a504f9cdd2ecdf8310d96088529fed72463a54fcd6c8.exe

  • Size

    785KB

  • MD5

    854ca372c90e86bd9a9dce642d7c1a88

  • SHA1

    11c86768112cfb75a3a9b0b8ef36997e80fedcdf

  • SHA256

    52a610b0ad89165f4a65a504f9cdd2ecdf8310d96088529fed72463a54fcd6c8

  • SHA512

    8e84e56178ecde6b20e3c605e146b001e5a1f4afe3101f299d18278f666ef4f478c68d3ec0dbe48e95960fb23ab970c1be6534627fe2029137b30f9d1f6dee43

  • SSDEEP

    12288:x1M0EGmwx0mUkw1tnPxv8opsdH0dwDIqkR:xuymwZ3UtPxvnps8wY

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2