Extracted

Extracted

• • Target

    asegurar.vbs

  • Size

    139KB

  • MD5

    b6a19737eef49bc1fda3686ea04fefd2

  • SHA1

    e4f14e237fcd865694ce29862f58c063c0efe995

  • SHA256

    93db398a854042d2a23e61cd308a05d21fb85a6b5c28206c585a6221ac583cd6

  • SHA512

    03145176ca0d828034a4c6907213bcf6478a64134a9fd7a79026ea5ae250dc79d43da1d0cb005e18d0be4bb46373d36302f7369bfc5457be745ba3f50072e887

  • SSDEEP

    3072:boU4gHKIuQzOTbEeqZfCPgyoL4EairFgt5pJGwm:bLKAubqZTyo9

  Score

  10^/10

  executionasyncrattar22discoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2