Extracted

• • Target

    fa9fe798ce4705a1ccbb22f8cb813c84e4abce585413eb7e26f0934443e75dbd.ps1

  • Size

    689KB

  • MD5

    e26e685d51988b2ae00c8e7a4ef256db

  • SHA1

    ba09428d9fdaadcd92a578d12a48dcb61d331856

  • SHA256

    fa9fe798ce4705a1ccbb22f8cb813c84e4abce585413eb7e26f0934443e75dbd

  • SHA512

    dc362252519f2637577e4b6fa3bc7df69cfa937fe9eaa78d078bfd24d4ea5b887f90319d1ae918b10c3ec081bcb35a7d436a173cae712d4d6e2f4f8f8af65eef

  • SSDEEP

    1536:or/BsVwGJ9iOowdWIa/aEgRJWb+pifHNutiQ3JlqmbNNnLRS2EFurYdq7PbAeVh/:N

  Score

  10^/10

  persistenceasyncratmay_1rat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Async RAT payload

    rat

  • Registers COM server for autorun

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2