Extracted

Extracted

Extracted

• • Target

    fv645458456550656894659461646_Pdf.Bat

  • Size

    28KB

  • MD5

    54c9e929aa6ea3e1e5957f9b0aee4e69

  • SHA1

    2c6e7d48b6951f59c4fcddfeb65b0e07e96394ac

  • SHA256

    c210d65973ad42a433a440c7716e92631c14ea6614f628ed0c540fae3b54e991

  • SHA512

    a075910c9707f49a9ffa6673ab2eb29ff3e0c2cabbb521ad7101c999f50bc7bd75b6e49eaa8d7f3d9db109c06bdbb56980b46317a23ed5d7d87dcacdd0e1ce2b

  • SSDEEP

    12:3xzJZ+O2P5g0it981k771o3tkRXFOuHeTgQ1tgQzu0:3x2P5g0i/7ZetYV7QEQzu0

  Score

  10^/10

  executionasyncratdefaultdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2