Extracted

• • Target

    032000-Denuncia-laboral-fiscal-juzgado-civil-penal-03663_u41xd04c.svg

  • Size

    1.3MB

  • MD5

    5ed94ec725013e918de4ae54a764ced0

  • SHA1

    af2a0a988b354c58b4bc5af02d559a3e2d9742f1

  • SHA256

    b7ccd7e8ef59f2ffa0e4efb794367581fb7150f2fa783fa351cf7ab0f4398c3e

  • SHA512

    ea9bd969a82af1863e52c3f572cf3c9f02910aefc28bd88d6b4f4b8acc1b13beb9c816d8429ff3753411c754af21657b11fb916a03a3cb6e787e6db407537476

  • SSDEEP

    6144:p+g/YHKrD6D+g/YHxvB/rD6f+g/YHKrD6D+g/YHxvB/rD6x:p1g6D6D1gRvBDD6f1g6D6D1gRvBDD6x

  Score

  10^/10

  asyncratdefaultdiscoveryexecutionpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1