Extracted

• • Target

    kandos - Copy.ps1

  • Size

    1002KB

  • MD5

    b1c605cbc77db41437b84a467d40ffa0

  • SHA1

    7d340e747074f4926e10ac216314c11b0d6cab7d

  • SHA256

    34ace3c06a59b838d2cfd9010491fc5e7fecdd4623d189a41d2b914832e7ff47

  • SHA512

    00352bde9482825cf803aa14f7d2b62f12bf8cd7b73b77865247912ba15e77f266c85a14c74c5fb8e18daa5c6489549010eab99f1f2cc91056a747b92aae4a3e

  • SSDEEP

    24576:caJ6JHbB8HN79uETiQmA/tZLzeu4T8/clnpszJsoEtt6cKsBmulv6KKGv69ndJK3:I

  Score

  10^/10

  executionasyncratdefaultdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2