Extracted

• • Target
    crypted.exe
  • Size 16.1MB
  • SHA256 b95d2c5acb71856aaf05e9476c0412ff6fe2c9c82d7ecfd2f9dc8be46d0be1c0
  • MD5 e7c93cfb7de935f5caa68c5256c2b291
  • SHA1 6f521ebbfbfdf9db6a073c5bcbf69c8a87e4fe72
  • SHA512 61269256e85b5f1d2375e660c59daa3af09cd7ce84fdfa2b3b1e475ff545230e3b9c7b157c39e7474c0be77ae20bc8aaaec0c12548c8ba7a297834cb61c07ea6
  • SSDEEP 393216:U1V2pgNTv4fShoh1+TtIiF/ZxS67Yx4rIhNsIGzWSuMnT+gqBX4:qE60fh1QtI6Y6m45IVi+gqBX
  • TLSH
    T180073316F2E44AFAE1E6153C97D24220AEF2BC749BA0D1DF02E902352F276D15F3A751
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultasyncratratsuricatadefense_evasiondiscoveryevasionexecutionspywarestealertrojan

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2