Extracted

• • Target
    c498a7a46ab8d62ddd222f679290cbf86eab6a95272517495548d05c53d44e0a.bin
  • Size 446KB
  • SHA256 c498a7a46ab8d62ddd222f679290cbf86eab6a95272517495548d05c53d44e0a
  • MD5 169989e03c6b2aa8a610ce40c6311d4b
  • SHA1 6656b005e1fe83b0e27329cafb166c35293f4a93
  • SHA512 0a908b79d6e4dd9a5d7762d027911e8001cb989b5a60f3015355f221d596203bf6a02dd335e001409f3dad59d35ec6198000a5e06c562708e946f2768edb8bbb
  • SSDEEP 6144:u4MnvFsCCuxQ6MgYp+GT2mIkyu8UfwDprjg/fMdABY2AFHAl+EElpF78IzbJJ2O:unnds5uy6M6i2rwfmpAeAogoEElpf
  • TLSH
    T1FFA401B4D7F8D251C9E3E7B5DB1D5BC64A68FA612C1C862FC042F41A6CB32C2CA54E16
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  jewdefense_evasiondiscoveryexecutionasyncratpersistenceprivilege_escalationrat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2