Extracted

• • Target
    adc6b85fbb55624cdd9a25d9634f08d3991ac60dce86c8f3ed520a88e36371fe.exe
  • Size 412KB
  • SHA256 adc6b85fbb55624cdd9a25d9634f08d3991ac60dce86c8f3ed520a88e36371fe
  • MD5 0731d232d0af12a5320238914de6bf4a
  • SHA1 41b1d57292fa942352373e587a638011893649ab
  • SHA512 a1af80997ce12df93cd17be40f78cfaced5fda36e1a601819e7e0790fa1efba13c2f818d45f83290707e3ac8e1fc54fea7f2d6a17640e83da5ba816ee629a436
  • SSDEEP 6144:y+YH9d/Ucs7XgCbXTFm2HTMFyowl07iLC0Ga2wdyRwIfjc6YRjd66Al:y5HUcaX5Lxm2atlf0Ga2NRwI7YJbAl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratexe jdidddiscoveryevasionexecutionrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2