Extracted

• • Target

    0731d232d0af12a5320238914de6bf4a.exe

  • Size

    412KB

  • MD5

    0731d232d0af12a5320238914de6bf4a

  • SHA1

    41b1d57292fa942352373e587a638011893649ab

  • SHA256

    adc6b85fbb55624cdd9a25d9634f08d3991ac60dce86c8f3ed520a88e36371fe

  • SHA512

    a1af80997ce12df93cd17be40f78cfaced5fda36e1a601819e7e0790fa1efba13c2f818d45f83290707e3ac8e1fc54fea7f2d6a17640e83da5ba816ee629a436

  • SSDEEP

    6144:y+YH9d/Ucs7XgCbXTFm2HTMFyowl07iLC0Ga2wdyRwIfjc6YRjd66Al:y5HUcaX5Lxm2atlf0Ga2NRwI7YJbAl

  Score

  10^/10

  asyncratexe jdidddiscoveryevasionexecutionrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2