Extracted

Extracted

Extracted

• • Target

    8620fa4c62bd53e5b70aa10e6205f1ceffcd49bd7ca3b01cbe8f539273dd6695.bat

  • Size

    29KB

  • MD5

    af0c16e6a8877ea5a72d5d4a876e8302

  • SHA1

    bc78be8297b41156b56fb22f7a84e7a85a183f7a

  • SHA256

    8620fa4c62bd53e5b70aa10e6205f1ceffcd49bd7ca3b01cbe8f539273dd6695

  • SHA512

    73ec801912075022dba96acb14b0cf6397b09af73b8e2535bb8870783196fd87ccbcb3f1530151c5c384f05d707d0bc593de33e33a85cb25872648db1884f629

  • SSDEEP

    768:gTYcpQyuPmhDGEhtKC7/ZAmvh3MT2iabBp2KHrxWPylMhQYXTtlE:gTYcpQyuPmhDGEhtKC7BAmvtO2ip88Pk

  Score

  10^/10

  discoveryexecutionasyncratdefaultvenom clientsrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2