Extracted

• • Target

    WWjjNTGdMh.vbs

  • Size

    12KB

  • MD5

    75f80ac848e2c5c71c5fc4960da7a430

  • SHA1

    abcd9316f8a1251220db81d4d075ae659a0fb790

  • SHA256

    2a08ea90518aa5b6f42d1ffa9632584fabe46dacc993732ac9776a71b9ac8acd

  • SHA512

    af4db86a398ac31f3b7d909ed62c8ea6b3672db933deadf32ae74e3dac581816372bfb0fc113f5b1aab462291d560516cadd52c655eebd79b7f639467c2c0ce1

  • SSDEEP

    48:UvvvvvvvvvvviddddddddddFP5+31HtwLhLtz/zzUSAzzzzzzzzzzzzzzzzzzzze:UvvvvvvvvvvviddddddddddZagKoJ

  Score

  10^/10

  executionasyncratkk_______discoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2