Extracted

Extracted

• • Target

    INFORMACION RAMA JUDICIAL PROCESO PENAL N0 RADICADO 2024-99659-9900236-999669-PDF.vbs

  • Size

    207KB

  • MD5

    438d60b529450e6976d4eaa1562328d6

  • SHA1

    e77ee5f7c92af0b8ad348515315c7a6eba0e00b6

  • SHA256

    0da4e2f6dea5afb3404219e00ca415c8cef6a5f556a3365be274881e62f3aebd

  • SHA512

    87daca922d36625f5a58d4dc77cb318ec70d000d6f0caf62fc78cf145cb2e46bd9b77f30b389555f23391377894c2e63115e4f8e9ec649fb1c57f7f03c5d3832

  • SSDEEP

    192:+QkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQkQk9:4HFzLPTLgeJOXA9vfTfpfRJaV27

  Score

  10^/10

  defense_evasiondiscoveryexecutionasyncrat14rat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2