Extracted

Extracted

• • Target

    fb581e31392f4c4b115ecd10f5e0e78172d24dd21f29d154b4c9aac0d37b1bd4.vbs

  • Size

    487KB

  • MD5

    b986c08f0e2537c2d572e38cc589b819

  • SHA1

    92c7c84cbbff104cd17f85008c1941a9cfdfa4da

  • SHA256

    fb581e31392f4c4b115ecd10f5e0e78172d24dd21f29d154b4c9aac0d37b1bd4

  • SHA512

    1bfb7df73543a2ba983a80997d4d01e6ae3cf9b8ca15c3aab9bc9e55cdd0b5fd3ec0f269d090b99c5debc95e4af6624a90bf066e40e51bd04b68e5a74ebd02f3

  • SSDEEP

    12288:busUyrshNMpnRa3/osFHbEahhxdSaq2JUqoq3DvAA5hrnv0xaKZSfCA:bbUjEs3/oUcaqmfJ

  Score

  10^/10

  executionasyncrattar 30discoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2