Extracted

Extracted

• • Target

    Leer Documento.vbs

  • Size

    29.8MB

  • MD5

    8f6a366451534b6a116ead97875cda64

  • SHA1

    207b773f42783fd28b4642c6cb670898ab1030c9

  • SHA256

    b6e8bd4b566117771b4eccdaf9f1ce0a7622a7d201d54db1876dd6d268e4b76b

  • SHA512

    020c48540dbe78abee20da7e45997271d018b3f2d3463563d6d363b3e703cc8488a29c8fd90c0da57c0c158639786f35817f73d0c3437f5357d304e73fef2e8d

  • SSDEEP

    1536:XPN+PFP4PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPR:ld

  Score

  10^/10

  executionasyncratdefaultdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2