Extracted

• • Target
    #9948-8465.vbs
  • Size 8KB
  • SHA256 da6181e22c0c7230058044b36945666bd5cb6eef577eed273f217b166335e1b4
  • MD5 8afc18095b72efb67ffd0d9e00480a09
  • SHA1 9e6f923a724eb96fde01d3598f62395f044b8f32
  • SHA512 7ab3c056fca8c91fbe7621f59f157aa1eff47d23c0f42976c99420a893ed43ab0a4ce49adaa527fd7707e68941d54de1517f3392c624444eb839873c48ee5cfb
  • SSDEEP 48:eYAZXoxm7byApD0G15Fjw7gr/f8BHQQRhUQKADSSot3n7Av9rL2X4JhAPAyUkvf:eYAZtvJDT2U8JQQJS5t3n7Y9rL2Ofdsf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionasyncratsasaagilenetdiscoverypersistenceprivilege_escalationrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2