Extracted

• • Target

    fc84e1e6ba3da99670ea27d83decb0d7fc0fd58c85b2d6990521f9b5f12604cc.exe

  • Size

    270KB

  • MD5

    2b7b328370a631e8516ae38ac1529716

  • SHA1

    b8440eaf2d72b21061534ba77028267478fae735

  • SHA256

    fc84e1e6ba3da99670ea27d83decb0d7fc0fd58c85b2d6990521f9b5f12604cc

  • SHA512

    3833e1ddd3a7fa258a26effa4b3559db79a7ffb9c9b0d6880b0275b0d4c5ddc921f77c279390263ca4d90840b316ca35fdd31ed388c57773c247961e4544a3c7

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sdka:WFzDqa86hV6uRRqX1evPlwAEdka

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2