Extracted

• • Target

    419929cb29132d4442411144a0836daebe9eddcb9498c583197479a728aac18f

  • Size

    556KB

  • MD5

    632fcbfdd3e602712905071c5a178e6d

  • SHA1

    350fd5a29c11bf2244f94465ed2e82ce71a72ca4

  • SHA256

    419929cb29132d4442411144a0836daebe9eddcb9498c583197479a728aac18f

  • SHA512

    b0ea0cba1a9e6e5398e363d2558f0105288b48af2fa40678ce416bd07b2a021427c85af487734288f9e5a9185a1faeb3f2e67ae1a199e9686069333a07458ab4

  • SSDEEP

    12288:ndBhrOiY7fNzGxb2w0T1Qhg8HM+M71ao7DVxZNywjzS:ndulzGow0ihhM71aYj3TS

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2