Extracted

Extracted

Extracted

• • Target

    lq.bat

  • Size

    39KB

  • MD5

    c052ebca60e2ce218b10804cb0cbc835

  • SHA1

    cb24648a8bf6adb4807798d5cc6551bf1a9f148f

  • SHA256

    bf0d1aa2019f057e23d62c1f8b69f63005a313057ff79592d2cdc28981c9d257

  • SHA512

    e535443cb726ef0d52175cf7164aab93beddfa00c388793b199d64e5ac13cd8a8eb6e740c278b7845829fbdd452e5c8d65edc2e163149f080f7d4f10a96b44ab

  • SSDEEP

    768:4yA400UEtvrU5cl7/2Vu2OHpi29NO150+5Rxbh:4yv+

  Score

  10^/10

  discoveryexecutionasyncratvenomratxwormdefaultrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2