Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    new.bat

  • Size

    23KB

  • MD5

    88758bf0dbf323c08f0bb5771283d5d2

  • SHA1

    3e382408a01c800e06f1d2664ffac0b2b99d409d

  • SHA256

    636fecec1bb4c562a86e26adf09aae32e19ddbe24c89799491fe7c47eedd79f9

  • SHA512

    edb5a939fac9364272b6e28a7f46a45370c670e937f10249091c88f9dad9bf1f8428f3a724465ceca841ad0222b3d5a11a117a29b3086a1755484fe30cca28a6

  • SSDEEP

    96:PVx1FVnpYIa6IE5bhNVdy7qYVksVx7Sldj7hT/YS7qYVWx2GziMCEYf90YoL2dHv:L889mL1qcHIX7sPe7TM8cRA

  Score

  10^/10

  discoveryexecutionasyncratxwormdefaultvenom clientsrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2behavioral3