Extracted

Extracted

• • Target

    Loader.bat

  • Size

    1KB

  • MD5

    84d66a793f6d1f8fb1f4726ee735f55e

  • SHA1

    db7f145a9685a3911f02bbc61a02546da06e68d9

  • SHA256

    504e74f223f13c996066449c7f279eb32a61f80f80c9e87d31cfdca6fee7373f

  • SHA512

    ab172682c693815c9bb902f395632785e0b24981f05eef61244c4311aabb79f94a4af9e1dc978ab2f3caa5b4db1b5cdd2ad896a61d4d8bb747750d702f1b907e

  Score

  10^/10

  executionasyncratumbraldefaultdiscoveryratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2