Extracted

• • Target

    9765_output.vbs

  • Size

    69KB

  • MD5

    f0a90fbc29a64f4274b014755f88c990

  • SHA1

    e8f7053bea6eab342edf9d80c15835b6fb6d9844

  • SHA256

    df37f986e4342d26e408aa370058ba21d218aaac358ba940bde7ac1f035549d7

  • SHA512

    fc42c09434d77f5688d23eab7700440196d07e517e3940d3b47484f2c4de214301063b9537febf1f3396fcf033cead22b4aecd68f18acc7c6f06f8f06ffc3c77

  • SSDEEP

    768:Oyq+h3xb1DhEhMXSHLGjhlZrkoq22Ub9aLILRNho4rBT9qDCJfJw/urPFpjw4g:lhBJihvKjhbQoDNbUILRUcE4wWrtp0D

  Score

  10^/10

  discoveryexecutionasyncratdefaultratevasion

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4behavioral5