Extracted

• • Target

    baf667160ac12440052daaea937cda4a7a341c5a50a6aa197182ee0419cb871a.exe

  • Size

    270KB

  • MD5

    1d80b76f8fca7f780584cc66433ab876

  • SHA1

    2e16c2d86211f34cce8602e2ca0dc393f005c607

  • SHA256

    baf667160ac12440052daaea937cda4a7a341c5a50a6aa197182ee0419cb871a

  • SHA512

    3db38d82993ce8a0566ef6f92fc631dc892a6c21ff2cd1929812c830baa8202882c9fa83b7181ef5199820418c22cf46174c714b0b9d4cbf1d5940352db68b27

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sd+:WFzDqa86hV6uRRqX1evPlwAEd+

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2