Extracted

• • Target

    ea6776496baaaa60c2825e976eeec430330246f54ad0d09ba0b05f64c19eb9da.ps1

  • Size

    440KB

  • MD5

    014f46936a5c013b91321a8278cea9b9

  • SHA1

    2be8ba3d4305a4abac91939e7baff191b0fe9173

  • SHA256

    ea6776496baaaa60c2825e976eeec430330246f54ad0d09ba0b05f64c19eb9da

  • SHA512

    93192da9d97f1d63d3e4e6287af0c1dd2b793af9b0b019d39116a384a1008a03d62daadfdcfbdeffa098581e630a39fb5145bd45020d90bf55955c284b96e781

  • SSDEEP

    1536:wUdAHeDN4NDabDzuCO4dfk2/o8wKhqydCZFy07GOQnAW9xrH8LtndfP9wRpnRvLQ:woF0tUVK7muzD5P6qAhTiNXY9E

  Score

  10^/10

  executionasyncratmado-marcodiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2