Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    06112024_0119_new.bat

  • Size

    44KB

  • MD5

    0a8189409a127612b858f940e3410212

  • SHA1

    44e4fd543179b18b9565c6ce4145ff61ab75e7f0

  • SHA256

    6ef23d5f69695cd8c9381e416928ca10e33a0b927c451399ab439eb64007a5ec

  • SHA512

    e4af985ebe31d0beae17999c893c7ad6824684caf863439f676a2dae9b2a6da74eddb41ca58b54aade9fb5ffabe93bd1a2db6ac21fe87f94b5d66c0a354b677d

  • SSDEEP

    768:gTYcpQyuPmhDGEhtKC+5Vcc8xJWWAF/U61RPMrQqMgrrLFAvzUk+imrt0wLm2PoL:gTYcpQyuPmhDGEhtKC2Vc93WWApUkPMy

  Score

  10^/10

  discoveryexecutionasyncratxwormdefaultvenom clientsrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2