Extracted

• • Target

    0dbe8c82a5aa9e855a45066018b480d786054c810cb611465cc6cfa0bec2e8baN.exe

  • Size

    270KB

  • MD5

    7a2b59d94c4497ffd26c841d481ae970

  • SHA1

    04a664510872b3a4d04de6161f08196ae08290bc

  • SHA256

    0dbe8c82a5aa9e855a45066018b480d786054c810cb611465cc6cfa0bec2e8ba

  • SHA512

    d0b5b442e8221a9b989ac772d474020d5d2ebcb94f198612b5752cf28cf1e106b7b1ad1839f97f9b8ea04300ca94c9cdbc0c48e106d081553de33d3ba2d16196

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sde:WFzDqa86hV6uRRqX1evPlwAEde

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2