AsyncRAT.zip
- SHA256 e30bc505c58406e47f2dc86fdd8cbd4c6483f59df22e5ad87ec8838a31fa373b
Behavioral task
behavioral1
Sample
AsyncRAT.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
AsyncRAT.zip
Resource
win11ltsc2024-20260709-en
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
| resource | yara_rule |
|---|---|
| static1/unpack001/AsyncRAT-C-Sharp-0.5.7B/AsyncRAT-C#/Plugin/Extra/Extra/Handler/HandleDisableDefender.cs | disable_win_def |
| resource | yara_rule |
|---|---|
| static1/unpack001/AsyncRAT-C-Sharp-0.5.7B/AsyncRAT-C#/Server/Resources/xmrig.bin | upx |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/AsyncRAT-C-Sharp-0.5.7B/AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/IconLib.dll |
| unpack001/AsyncRAT-C-Sharp-0.5.7B/AsyncRAT-C#/Server/Resources/7z.dll |
| unpack001/AsyncRAT-C-Sharp-0.5.7B/AsyncRAT-C#/Server/Resources/7z.exe |
| unpack001/AsyncRAT-C-Sharp-0.5.7B/AsyncRAT-C#/Server/Resources/IconExtractor.dll |
| unpack001/AsyncRAT-C-Sharp-0.5.7B/AsyncRAT-C#/Server/Resources/cGeoIp.dll |
| unpack001/AsyncRAT-C-Sharp-0.5.7B/AsyncRAT-C#/Server/Resources/xmrig.bin |
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=9, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=92, id=1, productName=Unmarked objects,
count=215, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=42, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=122, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=144, id=1, productName=Unmarked objects,
count=75, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=15, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.