Extracted

Extracted

Extracted

• • Target

    corn.bat

  • Size

    44KB

  • MD5

    e7a2eb0f8ad72bceec84b48c85cebbef

  • SHA1

    789f12e6755ba3e5995169f1ad575185360f4387

  • SHA256

    23474c7aca0d40d8920ba6f5b0ad5646f8d04075976ab3a53837dbb19638766f

  • SHA512

    aa66289e3b41c5dc7c9b9a03eb96a2dbd6a33a408af0136afeaec41759a4da782031098954091d76d39bbd67b574a0c590fdb774258d30abc4eb07ce337cd1b4

  • SSDEEP

    192:ckKne+fzSOWATUVF+qP7Hg1OA93vOOefDU4x4qL3JEgA9tS/Le2MGmHUQjw:cku1WATOF+qP7g1j93vp34xp1AGP20Qw

  Score

  10^/10

  executionasyncratstealeriumxwormdefaultratstealertrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2