Extracted

• • Target

    72cd6d490f03122c90b4a52c8bc7fb5b938123eaf4926b5cc5cee14f44bef3cf.exe

  • Size

    494KB

  • MD5

    a2bdb024c98b7e8d3d06fc86e110d204

  • SHA1

    2442360d37bf7e60b0d20c447bf5a0b51635a1d4

  • SHA256

    72cd6d490f03122c90b4a52c8bc7fb5b938123eaf4926b5cc5cee14f44bef3cf

  • SHA512

    b60afa45e29ddee3e3dc0d7e61bd5b9f3fb1d0c03a0655ab8f6c80b1fc5d6ff51f1b07a1af7ab1ce28d373f990d830f2f1c6e3c0e1efbaa280361a250ecb6850

  • SSDEEP

    6144:rTouKrWBEu3/Z2lpGDHU3ykJVX+tLC/Jm808PYfz1b8s4GYAMwX:rToPWBv/cpGrU3yUX+tLGA8mJbV2o

  Score

  10^/10

  asyncratdiscord hdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2