General
- Target UwU-client.exe
- Size 244KB
- Sample261012-vwrrnsytfv
- SHA256 ef977b955df7ad07c5c5e061331a92b9281b78d1dd5d2364907d1872f0fd6367
Score
10/10
Malware Config
Targets
-
- Target UwU-client.exe
- Size 244KB
- SHA256 ef977b955df7ad07c5c5e061331a92b9281b78d1dd5d2364907d1872f0fd6367
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Renames multiple (579) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Executes a VBScript file via the Windows Script Host.