Extracted

Extracted

Extracted

• • Target

    germ.bat

  • Size

    44KB

  • MD5

    cdbebe5916a327e5cb724137f5fa439d

  • SHA1

    7595a9c2978344b9be73c9478c1d6bac128bf0a3

  • SHA256

    eb0f82f6f7cae84885ef1c829836a368615045598db243904bfbd53d976e686d

  • SHA512

    6ae8f6c3fd0288ac1844e1cd84272220e3b9fa082dba0a27294ff83961f7a71e8b1924f46cc758bf3273d5c80862c451c6951500546e4827be0ed5cac67adbe7

  • SSDEEP

    768:fkRLJpCVvO1FA++aIWoECcej7NuIEEv8MYW+ANdZbQwex1LIGbtmCFQy5sZ72fne:tNO1FA++aeECf3A9M

  Score

  10^/10

  discoveryexecutionasyncratxwormdefaultrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2