Extracted

• • Target
    a.bat
  • Size 13KB
  • SHA256 77bfe9eb66b6c9196e5a54967956cbb4b5ce6d2dbc30a7517a8478c738e281c6
  • MD5 8f693928f972edc589a62b6644823b5d
  • SHA1 e4433322485430bc3559d441e0052fe2aa1bfff8
  • SHA512 2b80c2d39f0fbb7de782660e7234a3bc9b15977e8c3069c0fa82c7eb6aea4617c47a3176a7bdb25f4f32d10c9f578c4d0de48e1469602c591a0f533fb87e48d8
  • SSDEEP 48:ekkkkkkkkkkWkkkkkkkkkkWkkkkkkkkkkWkkkkkkkkkkWkkkkkkkkkkWkkkkkkk9:xQma7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratzgrat[[[[[[[___bat___]]]]]]]rat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Detects executables packed with ConfuserEx Mod

  • Detects file containing reversed ASEP Autorun registry keys

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    wHEwhGFVae.VBS
  • Size 80B
  • SHA256 613a93c8225f0b31ccddcb482477e41dba36e8d13fcdc1dbe2d17ecc90d2ccf7
  • MD5 d9878035fbe7a4a2ad83b4242917c984
  • SHA1 e0b04a4f1cf6cb863aa31b06e3ec25cece105da0
  • SHA512 332d9bdf29e19f5ebef016fa297725c0835e949fe061bcee38a0671ee2ae5655cb77507f43874fea935de1ac2ddac514cf9225ed47c4388982dec2c15f58545b
  • MD5 SHA1 SHA512

  Score

  8^/10

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral3behavioral4