Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    new.bat

  • Size

    33KB

  • MD5

    878627c4bca0ba302c23e3cda27b71f6

  • SHA1

    b530ab3d16cf53c9a397586c2d71e7374ad80e89

  • SHA256

    f70797c423c2807efbb81828b6a179099bc12a8adf852c02128cca7c67d4172b

  • SHA512

    f5e073b50b4042540e096f6ec691941b25f22f5fe3c3dd252a064a2672ac091910ef5711bd6f6c17b7af222d9f93063fc3f94be08eed57558c2f77d1917f318c

  • SSDEEP

    192:b+OyBLHo3fzcQD889AANVsoVVCB0+VZ3zdYxDcis:b+WN489AU+oTCB0YZ3uxDcL

  Score

  10^/10

  discoveryexecutionasyncratxwormdefaultvenom clientsrattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Detect Xworm Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2