Extracted

• • Target
    AsyncClient.exe
  • Size 163KB
  • SHA256 de0997525b3e663ff163ccf8d99b3c9b1f9f98581eb18ba153ba1cfd89d11bbd
  • MD5 dff769dfa86f47bd2cdec2e72a567ee4
  • SHA1 417c178e998fb50c4ad9262e3938ff6b1d46f77f
  • SHA512 ac13d8ae7c671df66cf8d6cc9ff03d8b57ddb49d5c545e794b03e216975bb6c3bd147094803b5eff719d2fa50f3c25066ee8ecc883ff4b6a3fe9b04517f80c56
  • SSDEEP 3072:RuGwTHbF1m2V9EYwDbKoJla3v7EskT8rmtIhvx:RuGWF1TVxwDbRC/HkTftOZ
  • TLSH
    T1ABF3104762380C21EBB4EE39A1DCD8BB495F6E7AB1A2464C7CB5FC5414F6DF1092AC06
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistencepyinstallerransomwareratspywarestealersuricata

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Looks for VirtualBox drivers on disk

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Looks for VMWare drivers on disk

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1