Extracted

• • Target

    moos2.ps1

  • Size

    689KB

  • MD5

    5df47d50e52c1cdb011c12bfe2ed1203

  • SHA1

    587b8357692cf1801a4aed650f5965ed5ee7337c

  • SHA256

    d623550382d57e1f3b8a521f00d4f05179da3073ac07d4ccaf4ced2999afc18b

  • SHA512

    096b87351742ab9598b8db72f889d1e75248a4c00e3bf5d4d0bd1ca048b023b9df5d412c3bb4354325f987830e2b795b623f22b766508ef89ccdbf0dd21729e5

  • SSDEEP

    1536:zJ7guVMqP/wdjeE4+vTrDLq4m/R6p0mZEWF7L9nGuWsMwAZJffqWyaUUhmQv/2sy:a

  Score

  10^/10

  persistenceasyncratcairorat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Async RAT payload

    rat

  • Registers COM server for autorun

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2