Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    new.bat

  • Size

    18.0MB

  • MD5

    35168f928a81982fc428113f484ea21e

  • SHA1

    2029d685911c351cea2857e12c1755df330e4978

  • SHA256

    496ba960a9fdf59b00191e7750cfc3940fe5a49610988799cbe3d9cc5d3f5344

  • SHA512

    4b2dc4e91c04180cb372460231e75270252f389231d759bcd96af05dbb479647d39e860e3f22dcf7041e8ec214a1a12125e8ccf52cd26f87d13ee163d58726ec

  • SSDEEP

    48:HmGJ3NlBmmTaQgTymDyb4J7rmxo6rmxoAbYk8OkeFhCaoe1aLHtZQ5ImvBSygyGV:H9FmmNfjwhSCu7OmLT7SkoLEu3S0yhr

  Score

  10^/10

  executionasyncratxwormdefaultvenom clientsrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2behavioral3behavioral4