Extracted

• • Target
    BYBBLJDYNKYQRCIW.ps1
  • Size 553KB
  • SHA256 1c8e29dbcd8795f22f73483b6e20929e0025fd113cd9b7b760aaf5aec3b5b9ee
  • MD5 223b842e87e7d124f133e2b21090e717
  • SHA1 99c830f860fe5d34b3802a62c790e0c26c7f1e5b
  • SHA512 f83274a71a388b0349cdbfed15ae152cfd3dfb45c22d81171a4e1a74f0a298a53b68d53fc75e15b8b08195f8d5020f33397d5d33dac2aa8826a5894680555db6
  • SSDEEP 1536:kDh8DyXBs84VhDEak0EyxWq0IxZQjepORUXl9cGnZneXVsl6cGMyQxI:kDhiyXBs84VhDEakbyxWq0IYz2I
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionasyncratnewjoprat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects file containing reversed ASEP Autorun registry keys

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    LOEVIQHNNBLMJQGX.vbs
  • Size 820B
  • SHA256 adc0a2c378fc9c87efbb3863c49fa0ac2a25e32a69e320105b79878d1bbcfca6
  • MD5 3b02a48a86c436a42cece067efd1616d
  • SHA1 7963c51e6de1389ea22c2fdff4f6ad436556e891
  • SHA512 cf0d9bc3e908e7a3153529e1e975d98806e632f3e5ce708e1c15f64749214d7ac4a02496af99a3a3af382c4ebb89ac31b3d03787303678c3b6b37158816e3523
  • MD5 SHA1 SHA512

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral3behavioral4
• • Target
    NOXOIMAYDCJQRTDL.bat
  • Size 1KB
  • SHA256 5e91677a0a32ced94580bef9253982462f9d9a7e5f2166a07561fe13f4342e98
  • MD5 f0615a271904779ef01a22ccffc5b7ac
  • SHA1 b18bab505208a2d1a53f7496286f25ac199b7475
  • SHA512 caa35c7111c525d8385e14b51368f657f9232b606dd6aa27fb580884264d0215435de234b4bfc155ec006107dfd94da978a73331442a2fd19c310348e3d758a2
  • MD5 SHA1 SHA512

  Score

  8^/10

  execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral5behavioral6
• • Target
    PLYEDPJAJZDJPATK.vbs
  • Size 887B
  • SHA256 735461ba3154b4804533018cf78b53bcf1fceff7688b3c3c64952ff0f6f04125
  • MD5 993627e0d502460f2b211b906e7f5cb7
  • SHA1 59d6ae8236d27c8f2f2b5abdc51ea77680e4455a
  • SHA512 fc85dfa5b1e34899f1ca98f4ca91b04fc3b29c819ded63df5fc382f63566d723bc3f93e2d4314d8ee3d7e6ba71b3aa05d02eac6248fc118d667358fa5fd67db1
  • MD5 SHA1 SHA512

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral7behavioral8
• • Target
    XKAHEZZHLYETQDGK.bat
  • Size 1KB
  • SHA256 9f7fc00e72e44ebc9b9f4b66bbf7d35a6eb6736f00a1ffd56100b6ea2ae57a74
  • MD5 20b2afea9d76846c78a9e7588a7135e9
  • SHA1 f307dca000a50208201c49324206bb6954fea3b3
  • SHA512 917d6c18f14d65563c63e7e7b1ea7913a7767f855e94ac0866ae02c268b8c03793876dec92d23789b9e055743964a1471a63e28130621675a3249c4cfd227726
  • MD5 SHA1 SHA512

  Score

  8^/10

  execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral10behavioral9
• • Target
    YEJVMCIJLIUXHSQV.ps1
  • Size 553B
  • SHA256 97c1c775cb48d543ec26c75c7b936a5072619427eba9a8518ac32d2a94a321df
  • MD5 0bc179668af7ed0a345b1c1a998c186c
  • SHA1 6b0c0e6f39c14dc0eb0be24b5db35a41ef8ff777
  • SHA512 163db9b801b350fee45eaa75156129641b25fb9f5281cacad97d6df6a142789171cda0c337ea0f8c5c943ff6e7e001f0db0ff3f4fcd8e0b005c0f0870133bfb8
  • MD5 SHA1 SHA512

  Score

  3^/10

  execution
  behavioral11behavioral12