Extracted

• • Target
    AsyncClient.exe
  • Size 45KB
  • SHA256 f35c81acbc8dd4fab7f36409d62d78a1371efe47709f5e97ab9388fc92ad6e6f
  • MD5 261288c22e087cbb17999d336d7bb4e1
  • SHA1 a373794c7ec273a1b2b1b529e23f79a8079c35e2
  • SHA512 d7072fec7066d63b4609cdff7eb692593ad6ea0614501badd3bcde5a865871aee85a15dddd2f3fb3f73af12bcacffc38388baf2be762f064af3e0f0aa5d57aaa
  • SSDEEP 768:husR1ThIn5PWUDvOtmo2qzpKjPGaG6PIyzjbFgX3ibYLOOSiqrcUywZ5/SVBDZDx:husR1Thsq2cKTkDy3bCXSELYrywZ5a73
  • TLSH
    T100232C003FE8822BF2BE4F78ACF26145457AF6A72603D58A1CC452D75613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceransomwareratsuricatatrojan

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • UAC bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Modifies WinLogon

    persistence

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1