Extracted

• • Target

    RW3B3_output.config.vbs

  • Size

    204KB

  • MD5

    3fbd3b678d861076338cc2839f315f8a

  • SHA1

    06738e398143f4f15ba633d9fbf0bf84df14c81e

  • SHA256

    cf9d43a42cb972311c8f75bccd9248d356879f205dbb037f1100c1777c4a2965

  • SHA512

    1b097663be0fade854d1756b8db848d0009f15964951ec94f5b61c7255e7cf247dfd94fca63a4da039fd8f73c5f1816016a0cd220c0b1d49e026279ef2068cf8

  • SSDEEP

    1536:abfH0Kj03LRy+CTb2PxmivrdVdKuTtwbDGgwVZYT/4HHO+D1FMbK:a7H0Kj0c+CoXvhvT+bzwTYUHH9D12bK

  Score

  10^/10

  discoveryexecutionasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  behavioral1behavioral2