Extracted

• • Target

    477f89cc7690210c0e3f3cee9f562708092b3770539367555ecd2b84b2699a96

  • Size

    7.5MB

  • MD5

    947eabafe59955146fdb714a09e74896

  • SHA1

    a229cea1a129676f7b7c3c7bc80a28e9c22268aa

  • SHA256

    477f89cc7690210c0e3f3cee9f562708092b3770539367555ecd2b84b2699a96

  • SHA512

    814a1ed776ae4dbff873cb61e72cad9b71fd8f813e38b203b7a68f351627685320aadaccfee160d2faa2f2867c492ce2428d0331aebfed6eacdc950b618a1e98

  • SSDEEP

    196608:TOIe9o8SdDSPvb9FLZmFZKPzs+l8By5k4SFn0r:yHm8Sd0FNm+bs2C4yn0r

  Score

  10^/10

  asyncratvenom clientsdefense_evasiondiscoveryrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2