Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    new.bat

  • Size

    33KB

  • MD5

    878627c4bca0ba302c23e3cda27b71f6

  • SHA1

    b530ab3d16cf53c9a397586c2d71e7374ad80e89

  • SHA256

    f70797c423c2807efbb81828b6a179099bc12a8adf852c02128cca7c67d4172b

  • SHA512

    f5e073b50b4042540e096f6ec691941b25f22f5fe3c3dd252a064a2672ac091910ef5711bd6f6c17b7af222d9f93063fc3f94be08eed57558c2f77d1917f318c

  • SSDEEP

    192:b+OyBLHo3fzcQD889AANVsoVVCB0+VZ3zdYxDcis:b+WN489AU+oTCB0YZ3uxDcL

  Score

  10^/10

  discoveryexecutionasyncratremcosxwormdefaultremotehostvenom clientspersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2