Extracted

• • Target

    Vltod.exe

  • Size

    993KB

  • MD5

    f870a8a57ae1743628a513a2aaab35c4

  • SHA1

    3f801da77dd5afa206d19a4746675359ecd84280

  • SHA256

    17b48e9aa4ea6dc0b97d9d4233806960051c384281a34fd0ec23dc4f3cb30250

  • SHA512

    378898ebb1c67e04706a0aa117578cabda9e874891b3a71c6bb046aaaf146c22a7417c5aae7aa36b6474994793d3ea42303cd64e63e3c504543eb82ebad3b28d

  • SSDEEP

    24576:sN/BUBb+tYjBFHB0X9mPGPShmXiM0hD6di/AY:YpUlRhA9mqsmXiM0hDTt

  Score

  10^/10

  asyncratvenomratv-lg60discoveryexecutionpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2