Extracted

Extracted

• • Target

    7a5c7d41661c07aab56e46b7ab2b4a40b0b8be68f5bf6770932c4925b0ccc5bf.bat

  • Size

    762B

  • MD5

    3bc876ec13e78ae0b6dcd7fd090e5d79

  • SHA1

    cc7e4241cc16734ee88c62d44e3380e3b8fea252

  • SHA256

    7a5c7d41661c07aab56e46b7ab2b4a40b0b8be68f5bf6770932c4925b0ccc5bf

  • SHA512

    7534ead66565f1c28e0295382407a68ef3426816c3ac3c374ea7be408d80ef0663a708baa9df90e756a27fbfb271651aff6ce8b5f5025f0ac6b3e254532177f6

  Score

  10^/10

  executionasyncratenerodiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2