Extracted

Extracted

• • Target

    21d27f29540147603af9a74b194f553342254ee4daea07359e6bd1246442d4f8.vbs

  • Size

    109KB

  • MD5

    4b7be0dcd6bdb340088d2dd657442b0b

  • SHA1

    960cac0a7a81530161aee49444fbb380d0f89fb3

  • SHA256

    21d27f29540147603af9a74b194f553342254ee4daea07359e6bd1246442d4f8

  • SHA512

    9dac7a96cf8b5eb1b608313a6bdb7ea86c97bce03ddb916874879acf994567c6020ccc4333c681b80e04e601a9ca49a787636d237f974ec3c6a87f85e504d7f5

  • SSDEEP

    768:eRXrFjNlww2JSTnnLIJhG/Hqgt5pDt5j2GwgvxXy7yPcbE:GXJZ6STnLIJh8qgt5pz2GwgvxXy73Q

  Score

  10^/10

  executionasyncratkllldiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2