Extracted

• • Target

    Client_protected.exe

  • Size

    6.5MB

  • MD5

    19574d1c471ceaa99d0d05321e7beba4

  • SHA1

    9c192eee06421e8a557b0afe0355545bae5366e6

  • SHA256

    df606ef08b80c10d12a7372505f51e2641b263ded0280edcaf9085e7419b5f3e

  • SHA512

    b73a16cd6f529cb8688b96f7039cfbca49c191b32b2240b56681125a4f8f63ceb625ae0077d1a845319f1a035524f314c95c3ef259cc7d284d7b557460db3244

  • SSDEEP

    98304:ytpOyr9VNf1P2tLnkJfA5Wmon5miZlE5aJ4aoAqq1k4MjNU+3:Z+jZ+5NgFbMy4

  Score

  10^/10

  asyncratdefaultdiscoveryevasionratthemidatrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3behavioral4