Extracted

• • Target

    1.ps1

  • Size

    257KB

  • MD5

    fa9de551f6fd38a4b04e3207e08e846c

  • SHA1

    2ef8eb4e82ce9f52e5fa61e04fec1f9b92230903

  • SHA256

    f8dae9c1f9c629a6811c6b2fc648b8f952a0331a1d5c04005808b4daeeae93fb

  • SHA512

    ed8024a8279f3ac1a4d4b3be7214b9ec0d429a7228ea126e298034c4952e0ce048f7c83d4e0aab0760701653a0a77aea82cd94ae5b59161cae811a93c212c3ce

  • SSDEEP

    6144:JRQRmeIR/ENCsOFAjL3vTV8MG0NsPSSzQw6ACnfRFG5jS:zXiL7XvLw6Ak6W

  Score

  10^/10

  executionpersistenceprivilege_escalationasyncrat29/7discoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    2.ps1

  • Size

    257KB

  • MD5

    1782325a32c0d152d2fc5f936764096b

  • SHA1

    32708733721654fd7ce18a2cc5859404dd365b48

  • SHA256

    e1dd619f137db33a6223900a330af2c9bb58b55b01504f142a27a4f44880a3ca

  • SHA512

    592aa5ef0a6b9f746538e503d40c250122a166db9fbd37ce08607b210ecdb09d7b42c5ca898d4b7ff0b3544f202aa7a52b7704f148f66df38ae9c836468b56a4

  • SSDEEP

    6144:aRQRmeIR/ENCsOFAjL3vTV8MG0NsPSSzQw6ACnfRFG5jc:wXiL7XvLw6Ak6o

  Score

  3^/10

  execution
  behavioral3behavioral4