Extracted

Extracted

• • Target

    Stupido.bat

  • Size

    457KB

  • MD5

    0ffbfd7a95ae6bbe959b1ae1fc7477fd

  • SHA1

    4aa50ea219154634845682a8f959c7d0e9a4c608

  • SHA256

    a914dd2a5ea2c98e706a7d2a6c4626b61fde1c078439b4e47fdd10f504dbcb7a

  • SHA512

    50cc626c219b425b70f77fff1cda8e4478652b4f7a167a52bf2c484a3000a99c7a9f745c79d9fc61a34257294f0c4e135157d073264e0c281de5d1867b0e42af

  • SSDEEP

    12288:kIk6IvENp7nGbZMfOGtLV2fVRB2isfFUfxzfE/Up1:kIw6lGGP2fNZOcH

  Score

  10^/10

  asyncratxwormdefaultexecutionpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1