Extracted

Extracted

Extracted

• • Target

    virus_src.bat

  • Size

    720B

  • MD5

    25cc17794b4a00de0db1dc2f14580af4

  • SHA1

    f119d7d9bc38af460a8da42c9dbc09faa77130b1

  • SHA256

    847d7d889d1d5dc33f7c24d82dccc71cb9032fd743e8a52364dc5e0a07a03e69

  • SHA512

    70b49b9b7f7798f3ae15dfe100bf19eaf734de4c92b18b75295b06e455d64aee16879432ccfb3d95c78cbe301600504cfe485ddde59745dae62d64dd014b83ab

  Score

  10^/10

  executionasyncratxenoratxwormcomppkgsrvdiscoverypersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect XenoRat Payload

  • Detect Xworm Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2