Extracted

• • Target

    38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7

  • Size

    694KB

  • MD5

    32c67f99f3c95ba5e1816ca208f9b723

  • SHA1

    c1e29ecea3c87d671448b9dbcc8d8c67b0d14b7e

  • SHA256

    38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7

  • SHA512

    578526bda2f08948475726f36bf247aabeb8f3941f95153d6786bc0db6e43bad44502ef1757bae2bb7c6f6bd0a4bd51e9b33ae363be293b75f490a26c03795f8

  • SSDEEP

    12288:btoKggb2iNdvpc++pd1yIBbrk4ct0gdK/5SVns2M2TgN/0s:5oKgK1XpSpGIZn9+YSVsggi

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2