Extracted

• • Target

    0969731d32678ac6f0be0896d03b2eb382d2dcd54645e55c621ea6152ebce8b2.ps1

  • Size

    440KB

  • MD5

    93bfb747191ea031f60faf9b15e7d43b

  • SHA1

    4fa4a763f1c7f4436b869eb2959542e0d966bb88

  • SHA256

    0969731d32678ac6f0be0896d03b2eb382d2dcd54645e55c621ea6152ebce8b2

  • SHA512

    b34e3dbdb6bcd089dc9df23d22344f0644ffdbebe79e8ae99ff13e07cfacf93df64ca3a77b1341fd4f02a485965630c129634a66446952c27a25a09c421bd281

  • SSDEEP

    1536:wUdAHeDN4NDabDzuCO4dfk2EJdMFXa/3qYrYUF1rGs4UPDc+dl3Cz6nKd35rmDex:w/XrXFWHlFHhfu88C

  Score

  10^/10

  executionasyncratnew-encryptdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2