Extracted

• • Target

    4698_output.vbs

  • Size

    203KB

  • MD5

    4b6a750839856ab620fbdfc0250b3efd

  • SHA1

    95474dd9bcf969c408911fa7500dc3ccc6416596

  • SHA256

    41e24d66f8bb13b08c6a41c4b4a2cbd52056edd2a17bec6f30fe3838db6d1f2d

  • SHA512

    0ce01f73301a57ca6dfacd135705f8662ba2cdd390da4afb0f9af27135f494da93d24fe5489a92de0f50766c63cef6b13db1095751f4c9f22f52d7aad87f8357

  • SSDEEP

    1536:abfH0Kj6qf7ANcXh5/vLQbFj7zy4XGCeehA5ID0ZG5xwzA7nogV6EAmqZlJ2B:a7H0Kj6iEij49XGCecA25qgoOilJo

  Score

  10^/10

  discoveryexecutionasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4