Extracted

• • Target

    PEDIDO DE COMPRAS OC 1203 CRI234.xlsx.exe

  • Size

    615KB

  • MD5

    934331eda0b472009322a97523b5bfdd

  • SHA1

    0af4e8f64595d302ba3c5b277403230b73277eaa

  • SHA256

    1466c1e6bd4b88ad92eac2240158c6516b8601fc59fc4260711c20e269ba17cb

  • SHA512

    57ce4f3fa2eab5b3792c83e045eb7a0d820b0c6172017fd41dd12f172f64fe2046b92e8bc7a0acf29d3f7d5b5aa35a3fe5fb60749a9bb07d6656bccd78c41576

  • SSDEEP

    12288:keq4E6mfJiLl9fWcbQkpClS+j80IlSgaFguAGszwTPXC2l93dvp1p7Cph8p:dEkD9pClC3ogaFgrRzwVdvp1pVp

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2