Extracted

• • Target

    BLQuote_PO385995790.exe

  • Size

    392KB

  • MD5

    837f18b7850efc1d72e08b8296665951

  • SHA1

    f8764fe781498410e66bde0aacb422cc46bd4dd5

  • SHA256

    70dc3a05f4d6138c0a26d6e05d85cadcfddef54db01d6cb48fcb2ff686de2f0a

  • SHA512

    ced510b32a57ff55448c4d8c82fe6fe344214b2477f61a771008cc4b92b4050c249619ff581156d3fb83ad6aded6025900704559d0dc1fadc9f7d04e2b225c99

  • SSDEEP

    6144:1lpSV36ggqbX5FPKXfRKQ/UahtFu1KJSGtX/Ke4ERP68MjtriKFuMfl0oj6:1lpmlbX5xK0QMaLJ7n4aS8MjtDlt6

  Score

  10^/10

  asyncratdefaultdiscoveryevasionexecutionrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2