Extracted

Extracted

• • Target

    https://cdn.discordapp.com/attachments/1318901750698217475/1318901950690889778/NOTIFICACION_DENUNCIA_LABORAL_ADMINISTRATIVO_POR_INCUMPLIMIENTO.js?ex=676402a9&is=6762b129&hm=c7a9369ee3e4a423229d1e006cd638ab4504a362d59775a9ef510acf67e80f83&

  Score

  10^/10

  asyncratdiscoveryexecutionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1