Extracted

• • Target

    4fe449d036c64073e840b18ba90368b895159740ee8596476e42125477a70ed7.exe

  • Size

    551KB

  • MD5

    acb979b81c2acf8de8925ac44a607e48

  • SHA1

    9be1e0bb48c9343c22f292089e4931f0ce739421

  • SHA256

    4fe449d036c64073e840b18ba90368b895159740ee8596476e42125477a70ed7

  • SHA512

    41b4e517540a5b2f225f967424c2d009cc85bb6d77398507770b1b474a4ebfd2361f695f380f6c9291cf627e693ba057b4a05c55b52f5c7e5780d37af4c15a01

  • SSDEEP

    12288:lxX3xXFdZd9HdkGIwHNLfh2AnX9TML8wHbC708POrXNiH19m9IWIu/rqkR:fzrd9HdkGIONLh2AnXkv8PeUL5WIyp

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2