Extracted

• • Target

    11123d69e824e0a71b1b6eb8204401bd9484630341b30875bb0f8a6cea3b3b62

  • Size

    876KB

  • MD5

    7ffee898b3e5bcb568717fc44dc81e8a

  • SHA1

    40bc0a93b02b32daff22716c400aedcae4ba9c15

  • SHA256

    11123d69e824e0a71b1b6eb8204401bd9484630341b30875bb0f8a6cea3b3b62

  • SHA512

    1327e940ae65514964f5973659ade4d8e906eda544e450dc8426c73d5a7c762bdf6f8523cd3440519a02d7a6e63f65dd7e128f0ba923560a3ed1ebb1a12d03bf

  • SSDEEP

    12288:2/ZGm9Z6QZJ85HthwE2s0Wthtrp/pQY4TCSxlMBhVjfspoIClj8sNylXlTNQDg:C9/A5NWE3zTZEuSxl61ljXolXLQ

  Score

  10^/10

  asyncratdefaultdiscoveryevasionexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2