Extracted

Extracted

• • Target

    sostener.vbs

  • Size

    438KB

  • MD5

    e62e7e185f8b7c1add47167fe2f9d732

  • SHA1

    b2a17258ae76d630a78f0af855e8f098fea90147

  • SHA256

    dc5c366ec0d83b4f56c482049378ad6ff837a0160c72620edd2021e270d4572d

  • SHA512

    3cd6e2257faecceac6b8c04e9def5620f3efdbf31afd1119ecea8edffcb96adc3e21b20609077b03c7c14755830f757579c2c5b4d05a8998f65bd240312cb472

  • SSDEEP

    96:8wDsQc7lY5K8kyRllDiq0qzhELI/vlewa0bO:8wHOlY5K8kyRl9iuhYAvgwpO

  Score

  10^/10

  executionasyncratdefaultdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2