Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    02102024_0159_new.bat

  • Size

    17.0MB

  • MD5

    3a6a863c82f5ad5ff271a7c740c1ab88

  • SHA1

    a85966b120a257211a5f2a245ac94244d5a77019

  • SHA256

    bc8ad4687d5b06fbcd16b1a119b0cec10b8063ff0154dcacc6e3e30a5ce9f2ba

  • SHA512

    79f8309de480b45d21520f18180ade1367217955e8e6e50b1251b28921bd8a5f2382382c21a5ef556282fb37dabb7337425a3bd658d10f8d417c5b21e022e10d

  • SSDEEP

    768:U6MPI1xfXAU2HVp93Cs5MJVBIkCm6M2EHC5w+wLfm6/95h65uvh3E1cQAAaBq3If:U145

  Score

  10^/10

  executionasyncratxwormdefaultvenom clientsrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2