Extracted

Extracted

• • Target

    Informacion detallada proceso de citacion fiscalia No Radicado#2024-996569-66332368-999650023-PDF.vbs

  • Size

    207KB

  • MD5

    3a463161808ec6ca767d6f33717b6d09

  • SHA1

    dfce6272aca63db2237c10b8dfc1f049bd2a69da

  • SHA256

    3b2f343d09a33b6f15664c3c7cab05b149470aa2c1320784326b03eb66b5aa61

  • SHA512

    24d960b49be770f85ecac0bd7c53f7963d05317de23c3c4c0a722a644e1a3642f618956f46858a7e2fda6f2996bee0bbc5ac97c552e8269dab3c822ee52ca52f

  • SSDEEP

    384:233333333333333333333333333333333333333333333333333333333333333q:WlzLjW

  Score

  10^/10

  defense_evasiondiscoveryexecutionasyncrat19rat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2