Extracted

• • Target

    255c4ecba922d8b56534bd7a571525c67eb39bbef0f18bc96e414160a95fc2f6.vbs

  • Size

    897KB

  • MD5

    c983e816294b2d4c2213db5bc4339393

  • SHA1

    4eb96d15af10865ac93ed29ec475bb8eafe91ea3

  • SHA256

    255c4ecba922d8b56534bd7a571525c67eb39bbef0f18bc96e414160a95fc2f6

  • SHA512

    fac24fd9947e732069c7a3fdcb91376ace629ace66b1e0f9fb384b9ca03725c7f39b8f817c4bea4593595f30ebb67083fbafaebe61bfc59a3176caddf3aeaecb

  • SSDEEP

    12288:qzTzUyR7hSRac+qkLmttaGgMskgqoiMHsp90:UXh+k+taGKqoJO0

  Score

  10^/10

  asyncratvenom clientsrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detects executables attemping to enumerate video devices using WMI

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2