Extracted

• • Target

    startup_str.bat

  • Size

    382KB

  • MD5

    8b1f260a182f74419011f14a8ba21a37

  • SHA1

    48d8da3f5971ebd6b358b6b63491b5e68f099a6c

  • SHA256

    478ca90bdf1d94b880dd18c1fd1a5b6124d4e1c4b77c546df88a0aa992aeb225

  • SHA512

    509a8b51cb3922f9be6c94029abbc4611b1ce438262abc9fef414780e97d7542d214ae42866ccaf540b52e6cfef017abfc00c891643b3b81753c9f4115ad64aa

  • SSDEEP

    6144:UJ+xnM15AXYHvdijZhhzPrJaBuLEQ/npzItPvshlqfyef:f8udDJ5hmPvqlRy

  Score

  10^/10

  asyncratunamdefense_evasionexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2