Extracted

Extracted

• • Target

    5b30c27eaca00c51aa594df7273f8e24d84d08a6c085147697e21b082e3e7812.vbs

  • Size

    1.9MB

  • MD5

    640864bd8dcc33f7191cea6e8794a386

  • SHA1

    6b651ed9e576d72b6c53e975e555572701fe2681

  • SHA256

    5b30c27eaca00c51aa594df7273f8e24d84d08a6c085147697e21b082e3e7812

  • SHA512

    ac0b98a599ae60043b4d652d7f2826f26918ae6eb2f99f2dec7c14b34d74bea25264da0962eef619e1c72f67d181c4a1c1d52a71a5d7e734869a18300805cc11

  • SSDEEP

    3072:BiiiiiiiiiiiiiiiiiiiiUiiiiiiiiiiiiiiiiiiiihiiiiiiiiiiiiiiiiiiiij:8

  Score

  10^/10

  executionasyncratdefaultdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2