Extracted

• • Target

    Dmningsanlg.cmd

  • Size

    5KB

  • MD5

    c3740f8a31835df5862ca4dcca3f046c

  • SHA1

    fe66ea2e8830e2e05c33b2f57dde0667fcee046a

  • SHA256

    5ec6b19b04ce92c96099d82aa9f698afea763e0dd95fa33fcda302028c1ba931

  • SHA512

    d4edf552833604b184a21a095ff69be1cc260b7a31e0c5f6e02d52d8c5df9b19d315585493d0a9d8edca21f0272e5795e7f9fb3c0d05935dc11f7183a0ed7fbd

  • SSDEEP

    96:fxgDNkSWe+Y7mM2lIg3WU+ynD0jwDOe7o/SJCRNE7/WtBFCV4N6AWYs9skq7WSPu:fcWJY7J2B9+AD0jwDOe7mkCRNoWLFK4i

  Score

  10^/10

  executionasyncrat8nyyyydiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2