Extracted

Extracted

• • Target

    00421ec0e50c06c0d20a438de1d7f355b02ac6bec317bb4493fee4e291833f22

  • Size

    13.0MB

  • MD5

    66f293c1394e81b02da06a86f5bcb249

  • SHA1

    ac0b8acc5eb9395d6a8a40be01a3e75a7208e23c

  • SHA256

    00421ec0e50c06c0d20a438de1d7f355b02ac6bec317bb4493fee4e291833f22

  • SHA512

    b3bd8252473e9960cdf32d3d89e6f1df3ced96621ae12d085e58705dd12803d5a3e90e1a6899545921f7f32f2bf9072fd26d147a0dd2fb4d3edc21f0a756ca1e

  • SSDEEP

    393216:mtoHOLHsaSZ2pczKc1esHdZYjzGLO51D6GCoJ:NOL7mH9ZEN5h6RE

  Score

  10^/10

  asyncratmetasploitdefaultbackdoordefense_evasiondiscoveryevasionexecutionrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2