Extracted

• • Target

    1bd13a28f62855a85170033ee25f73c387b512b0042be9314981887074393d0f

  • Size

    272KB

  • MD5

    ddd9a73f6b017c6839674d5e6f665c3f

  • SHA1

    cb3f1debb913d6cafab38102c9f35b6450c3a3ac

  • SHA256

    1bd13a28f62855a85170033ee25f73c387b512b0042be9314981887074393d0f

  • SHA512

    41ef3b93154675266266dde5bbf579f54931ed3295ccaf1f2817201dbab3f07c1632f3c57a21f8d1bc9cdd02eba2f05735c946e6a4e17096e5ac7040b2cb0aa6

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sdTo:WFzDqa86hV6uRRqX1evPlwAEdM

  Score

  10^/10

  discoveryasyncratpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2