Extracted

• • Target

    85d9a7d75ece0120c82dd2980532c1c4eb4e5a76e58a228aeec21aebc307a100

  • Size

    262KB

  • MD5

    bb3d025def36b30d2fb3f442995fba03

  • SHA1

    6c19a62c2823afce16fd56c9f7ca3fc34c04d49b

  • SHA256

    85d9a7d75ece0120c82dd2980532c1c4eb4e5a76e58a228aeec21aebc307a100

  • SHA512

    22322032c27e91970b4907cb2d14d889dffdc95f9914788a4f312518bb9b3172eb70bbbd8a32879b28d6fbe24ca721c8424c0c0dac3e247f2424ef318ab789e1

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/eX:WFzDqa86hV6uRRqX1evPlwAw

  Score

  10^/10

  asyncratdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2