Extracted

Extracted

• • Target

    00254-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA DEMANDA JUZGADO PENAL CIRCUITO RAMA JUDICIAL/012-ENVIO NOTIFICACION ELECTRONICA.vbs

  • Size

    30.4MB

  • MD5

    2063532fceeb572f8611f222dffd01ed

  • SHA1

    f0d1938c04c06c9fa2f9f64408159f8a18404e0a

  • SHA256

    980a6398745d8c656a7270b782d779c7328ceffa91e8bafb2020d0983ee1c1aa

  • SHA512

    5bd582557408bd505e6c586690b12cd3a7463372c6f4aa1801c76d75dee7ad1c31a2515f3f508d875c806fc7d7f1a1e7be3e4f451029ff548346bfae0e2a3a97

  • SSDEEP

    384:SHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPA:eECOzjL1

  Score

  10^/10

  executionasyncratdefaultdiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2