Extracted

Extracted

• • Target

    ACTA DE FOTO COMPARENDOS IMAGENES DETALLADAS RADICADO No 2024-99663326-9966566-9996589-JPG.vbs

  • Size

    207KB

  • MD5

    435df20a9b01d9e40b5c8bfcc0d854f3

  • SHA1

    ae3f4580799db52473bd2dc41db7903819f3d8e1

  • SHA256

    3a27d687ad30981166c9b94a4bb30eaf4cb57ceaa6276531c544c0073047a0ff

  • SHA512

    613f815e2bcc7dbcc0c1dc591c9ba551678ec32d8bdeae58be17d5ac8cbc663760c65a171696df5ac26a74e4307ea87b10c006397d905e5ef69a8a8d2d75e907

  • SSDEEP

    192:7///////////////////////////////////////////////////////////////:WHFzLPTnRStYhSXIBoFN

  Score

  10^/10

  defense_evasiondiscoveryexecutionasyncrat18rat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2