Extracted

Extracted

• • Target

    NOTIFICACIONES_ACTIVA_EMITIDA_CORREO_SOPORTE_COBROS_5638945847483759479347674893679047698406747690384674398609409673904698798476948694698968986PDF.vbs

  • Size

    8.9MB

  • MD5

    199449f2ef2026f61889f3259d30f387

  • SHA1

    253f7b5e019ff159b10844d662b9d2b9331acf62

  • SHA256

    80ba2478e4695de6db6ee1bed092eab38cc6c4243f3ba6e6a16ca180a68520ed

  • SHA512

    9151040021d577a3b76192d128d2c1a3d22ba74cd38ee82662681914fb1d466ac88e40fd592c606f6f84fb36ac13b1dd2ec7091ab07613a1bc3fb0ee9293743a

  • SSDEEP

    96:c6G7MI/Gs/iYNRTz3vnqAJ4QrE2zzdRfpb7jhI6QP39g7d5qI:bqyYNRTz3vqyjdRR/jhI6k39e5X

  Score

  10^/10

  executionasyncratzdefaultrendiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2