Extracted

• • Target

    53949b99b9556d09fe8d11ec6d41d96055a9fbf2a31360f38ab18b26b6511219

  • Size

    693KB

  • MD5

    32a1c8ff16fa3dde2509d9cf26f79ba0

  • SHA1

    eb8d087b2be3fb85375b77244e4a8e9ea5d6044b

  • SHA256

    53949b99b9556d09fe8d11ec6d41d96055a9fbf2a31360f38ab18b26b6511219

  • SHA512

    b628a47a0e3d5ae508093915b844c480b4fa31b7bed8ed1fbc19afecc7225228c176c0a018cf3842a92447af88cdc36e7e82e1303a1f0078c6ce3854f1836088

  • SSDEEP

    12288:C+JoKggb2iNdvpc++Ghkd1fW1xLeM2TgN/0s:CIoKgK1XpS4u+Ugi

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2