Extracted

• • Target

    2.3.3.exe

  • Size

    1.7MB

  • MD5

    6eb122e96a700bd2b8cc99145e341dca

  • SHA1

    cb7b638457cc0c9d91f2d160cff668be728e98e7

  • SHA256

    7fdd01a97937e772442349582da60906c7af11674de1d2e7b5d8ef735d541310

  • SHA512

    a58e58533c58adc4e247d7a8e9f96034e04083b58d24b4f31ce191722978a2544d620e44d54ede8956698267dda2466303085d2f4b013859d928e915551d73e4

  • SSDEEP

    24576:m9ohkx17Y1hjhLYgHZ/3n9xNGEDx6sjoduqJaa+WB0cmukAoArSnw4GTNL2aa3/K:2skxe1/vNG2jSuryBJoeSnw4uO

  Score

  10^/10

  asyncratahkdiscoveryevasionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2