Extracted

• • Target

    fsp.txt

  • Size

    10KB

  • MD5

    c9f569bd4a2bdec00f03b7e30f47a8dd

  • SHA1

    2cdd9694e58e8f3c9c8607f5cc6e31d10b482c32

  • SHA256

    7b73596346a36f83b6b540bfc2b779fec228a050e6d7de631d0518b526b9b128

  • SHA512

    98d631ad7749c3b7ebd02da6a00796f66951d42f9142fc1bb459904da253f8c90e974a491d4f1e1364f786a8ae8022080a24840260b01f73fd73e8c0fe9a54cd

  • SSDEEP

    48:/L2tePUutEk+hDnqhdN6+W0K00ah0ZBjAPa:T2kPUGxwqhdN6l0K00xoi

  Score

  10^/10

  executionasyncrathemarat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4