Extracted

• • Target
    LazyClient.exe
  • Size 47KB
  • SHA256 44c5c3d6f359f410ef228e655dcb832692b4636795ac9c42d424674e51dfcaec
  • MD5 a9b2abd1c7cd69b626e73c13b2fd258e
  • SHA1 8e70e7da665c1761bd94adc37379bfa81c079629
  • SHA512 5d2185bff1e881ea7d8d504f9a15bc94d2a3f8d961406e62a24862b53e026af963cf4fef8ce6f8d332ac88774500f3638437b63db6abc358939704a449bb531a
  • SSDEEP 768:huyZNTAoZjRWUJd9bmo2qLnoal0qCqzjbbgX3icooWJYAdHmEuoMZGf+:huyZNTAGL2gl0lq3bkXScEYuHVu9Gf+
  • TLSH
    T119232A003BE9812BF2BE9F7898F32145857AF2632603D64D1CC452D75B13FC69A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  rizdxdefense_evasiondiscoveryevasionexecutionasyncratumbralratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects Umbral payload

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2