Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    new.bat

  • Size

    10.0MB

  • MD5

    c16890f92f82d9aa09e0863b9b972fd7

  • SHA1

    58095238d31afefaa103a0ba7c9be0c5f76d4049

  • SHA256

    8e8027584954b310a51dcedd2d905e557be41d1a14a2edb80f0026bd80d33048

  • SHA512

    ccd09d87f7332b227c167c24679f253eb128062073549db799b24d7142b5e77e1669a403be552cda1f82fe608c1e5f9655f7d1b789b0913ff7aa8b203542f295

  • SSDEEP

    96:t57sU5Mqwt3o3h2lvzNxmjNzFy5lKXX0lPuvRNUurK2Ltb5MAkZItmniAvTFI4Ns:7A4nQoBkdGpcnWw

  Score

  10^/10

  asyncratxwormdefaultvenom clientsexecutionrattrojandiscovery

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2behavioral3