Extracted

• • Target

    6890_output.vbs

  • Size

    46KB

  • MD5

    653bf44f38fbe35cb4a51a366cce85e1

  • SHA1

    5f08110e8b8174d62eb8beb3d8eedf507dc6471c

  • SHA256

    0442d85e2af50c1f41e7cbf46850a204cf7cfd49eb5f0244e8b60cc28c313c24

  • SHA512

    ed5c78d769eed4667ce8cceb14af498fcf41c36db88e47611f2157708513955a188a9aa60404cb99f632ca2b10596dfad60df3a9320083b92da14529ebdded19

  • SSDEEP

    768:msJNohJ2GoBFClzkP/TFYgZutKI/OLixhGpOQU40GmaXQq9+RfomiJrW7PuA9:mTWGsClzkmtKIxGp1UOmWYfomiKH

  Score

  10^/10

  discoveryexecutionasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4