Extracted

• • Target

    vd.txt

  • Size

    10KB

  • MD5

    f3a9219e977b293b8cb364f8c8378284

  • SHA1

    6f5ee3933bc669d7af2acccc842c60db60be16f4

  • SHA256

    b72c0371a70cfeab0cfe44b72ef08716f6a3345cce395453e4cf931bf1f603ae

  • SHA512

    3960ed3091dfe3845832af7911c227c3e6f0cdfb97fd404224e1361ccb3d78e7b20a98fd3397ddd7e254113fb81983ca30f90cc28751390da3964a56ff2bfd91

  • SSDEEP

    192:RMVgS5D/dL6hq20J0FeAPZIxOImBYb/QFfW6V5k6uS3N7AVzSXqLFCy+/7lm70OR:RMVgS5D/dL6hq20J0FeAPZIxOImBYb/h

  Score

  10^/10

  executionpersistenceasyncratexenewrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4