Extracted

• • Target

    V3xSolarafixer.bat

  • Size

    395KB

  • MD5

    003edf4319e31d48f44daee2df888005

  • SHA1

    bcd6f33116f746a10185af4d17cbf0357c11657b

  • SHA256

    60193565df3a7afe6f4bf343da48595a20bc8afed9d60f890b6a2d1c1ce8b65f

  • SHA512

    1e961d0bec6b7368d6f6732ca854c995f3caedd3e87fe3a809f5b263d866adc6146295e60fdb0216257b709ace3836241210617d6060cf8b56e74a9d5e52785e

  • SSDEEP

    12288:NsUM5zunGyNyChna0ZF2NB6RjTQ+SXbBBoz9u:Ns3zuVZxZF2v0QntBr

  Score

  10^/10

  asyncratvictimdefense_evasionexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Drops file in System32 directory

  behavioral1