Extracted

Extracted

• • Target

    DOCUMENTO_SISTEMA_REQUERIMIENTO_DIAN_PROCESO_DE_EMBARGO_REVISION_INMEDIATA_ad8098904901470147f818615891658168ca7555f5757728471229_pdf.vbs

  • Size

    68KB

  • MD5

    722ef0f62d5f0d96f0f63888e0d8ae39

  • SHA1

    0afc5ebc973e07bc01682922e5972dbfead09691

  • SHA256

    b2bea3384dc24126675379eb1473946f2927a10d8eff6730bc024716ef0f6864

  • SHA512

    9e614dbf3ea73992903a5a93884733ce4346e9108a78fba4f0ded8200cfd0fc33a929cebf2a1236163e63e6e33ac0b0daf8af8e881bb125f9cd57986db5454b2

  • SSDEEP

    1536:bUJW4Wrle/PhG+/kery+bGNccc3gt5pzaUGwm:jS7rgt5pnGwm

  Score

  10^/10

  asyncratzzzzdefaultitdefense_evasiondiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1