Extracted

• • Target

    2.ps1

  • Size

    1002KB

  • MD5

    53c4c7466cebb3357a4bf5fdde6e03bd

  • SHA1

    3ae57e66c6651b2c35b873db5de86b87ccc969ad

  • SHA256

    ec7d6975587d8dd4effb5727882b1fbb867766d4df73ec304c88d27362ce6ace

  • SHA512

    aa7a49bde2e30748853b66c772d5bc72372699d52a0d4806d373e870eaa0488ba6ff7b92669e15c9b0180f4cfebd45e698a75b514512b6eddb338dfaf2d2a75e

  • SSDEEP

    24576:TawjBUo3v/AOhx415r2X0Kin4clpSeuoZ+tF0USjpMmaXBxwP0oOGAlLRqkbx2yY:e

  Score

  10^/10

  executionasyncratdefaultdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2