Overview

overview

10

Static

static

3

4gtslj9.jar

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4gtslj9.jar
  • Size 3.0MB
  • Sample260831-3j77wsaf52
  • SHA256 2e3c83f927e29d8b2788edc8d9d3b214f046048de47d04819880007031ca38aa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
asyncratdefaultdefense_evasiondiscoveryevasionexecutionpersistencerattrojan

Malware Config

Extracted

Family

  • asyncrat

Version

  • 1.0.7

Botnet

  • Default

Mutex

  • DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

  • local_host

    127.0.0.1

aes.plain
aes.plain

Targets

    • Target
      4gtslj9.jar
    • Size 3.0MB
    • SHA256 2e3c83f927e29d8b2788edc8d9d3b214f046048de47d04819880007031ca38aa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defaultdefense_evasiondiscoveryevasionexecutionasyncratpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies Windows Defender TamperProtection settings

      evasiontrojan

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Windows security modification

      defense_evasiontrojan
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks