Extracted

Extracted

Extracted

Extracted

• • Target

    22112024_0201_new.bat

  • Size

    3KB

  • MD5

    58ce685ec1ce8644306dc4906242dcb7

  • SHA1

    2f9dc4432e1d211e54aab97831fc3b0df5e86df2

  • SHA256

    5ecc7f700bde0ab833e9a955d8ad371fab96e5a8c52d148488201e7815973725

  • SHA512

    249ea3b3477cda22985e504f2a028ef370cc06fc4bd6655a7d18ecb26e0329e981720ccf234932e155b70a99131b95a62f8324ebcabe3652ec3b5c0c23fd0186

  Score

  10^/10

  discoveryexecutionasyncratxwormdefaultrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2