Extracted

• • Target
    AsyncClient.exe
  • Size 49KB
  • SHA256 bcb2aaa30b4b82fac636eae9a9f290dfe43ea5023de8036c8ba3c0c66bf7be38
  • MD5 ee0a41b295e9db0fc48e4ca1269023fb
  • SHA1 6923999c64cb9c52d9fd2d1a9ee4921650d11ef3
  • SHA512 05b011d1fc3f71dddecfdf98068b9b41f7203483b552fb8e324861a3a811a0bab19cccc8b0b609f1eaa13aeae18a6dd496b3886159767d7dae8e4564c93652b5
  • SSDEEP 768:jREHhW9C3crugN+AqPwngvAzBjbbganSsFDaPEGP2GnXjmFf+:jREjolbka5kO8XCFf+
  • TLSH
    T187333B007FADC12EF6BE8F78A8F2314546B9E2673503D68A1CD411D61613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  testdefense_evasiondiscoveryexecutionasyncratpersistenceratsuricataevasionimpactransomware

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2