Extracted

Extracted

• • Target

    sostener.vbs

  • Size

    438KB

  • MD5

    7038e85f1e6e6405981b64ff58358482

  • SHA1

    9df67362f01d7a33a02a708fa6da1c3a1214fc51

  • SHA256

    a1a8e23d2f66e05da76366469a1a344973fb1d775a943656de0f90bf0306e447

  • SHA512

    e9bc9b726b17f8f513d36054647537d6e494bfb0087306ca52ca0f1f95785afa705ede98baaf71f19fead408f434a061a34ac6f0c457b0b77bdc51f93005c676

  • SSDEEP

    96:OffffUffffUfffflDXc7lYm8ky0xbFi1msE4VIAGYALFCN8V0bf:s7OlYm8kyIhi1msJVIAGYAZCN8qf

  Score

  10^/10

  executionasyncratserverdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2