Extracted

Extracted

• • Target

    13112024_1857_RAMA_J_DEL_PODER_PUBLICO_NOTIFICACION_ELECTRONICA_RAD_129939214091249_POR_FAVOR_CONFIRMAR_RECIBIDO.wsf

  • Size

    1KB

  • MD5

    817379a5c3f383c5586acd71d5e8adf5

  • SHA1

    6139bcd7317b3a3de045b1da994f8924d6c79f84

  • SHA256

    7548f1ad49f6fd2a5e2aba00613274674f2ca6424dbacb41717098ecea852f70

  • SHA512

    d2d75ef1296712a678ab60b0d3b476d228bdd5c10b8e9b75c7dad91a5ce14d0632a176271623366b501405c6dbee7d1c79d0ebbd389b04073c18cb2020d1da7e

  Score

  10^/10

  discoveryexecutionasyncratbrazrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2