Extracted

• • Target
    SystemHealthTray.exe
  • Size 7.2MB
  • SHA256 2efaa98a4d928cc5ef26dbf8dc1506f763a7028ef0a7278588aa2dfea81e300a
  • MD5 4fc62a595ca474abdb7dda97d49fac8f
  • SHA1 4363fb354424c1197523ab49f4831f22816b3887
  • SHA512 c5d17dcd3c3031ee77263edfe22015ab2d7c83aa7b5ba34da62d2a8d17c3639a53fa0777fc228eb114b0b34f57906de000d19f7808809b2f8b16afce27286e8f
  • SSDEEP 196608:XINBEbuXV7ICteEroXxjczlxZV3Gu5D4S26/CS3z/hdE5vNLoLPKA:aBE2InEroXe14S26T/XE5Bf
  • TLSH
    T167763344B3E81CFED9BB847AC428D829D1F2B4204394D59F27AC851B4E6B6E07D7AF44
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceprivilege_escalationratvmprotect

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2