Extracted

• • Target

    DHL_damaged_package_jan_2025_92818217221.vbs

  • Size

    18KB

  • MD5

    c75965dbddbcc556f2cd3e9f05b0da65

  • SHA1

    c19fe776303d0d5dd56cf5306a4acdde829237b4

  • SHA256

    8c4fc4c84ed395ac91e4ac2d1d124f7383703adcec53e6064475be947c52abfd

  • SHA512

    370240fd84288a9a1cd2303c70823518fbeecd88a7c5aae7a8e428e48db05c090bec6251a0e864e1fe42e3d0082f3f5e0ba36dd37fbf9bb943faa8dff7d8cde7

  • SSDEEP

    192:/k1i7Pg+WGy7HYqr2O5ZDtN/0+QxBAx7cCuAsTDgaPH4MPX2BmFfkd9ZyK4Bvrgy:c1CPo7nLWidq43U2XDnrwzun0/

  Score

  10^/10

  asyncratdamaged_dhldiscoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2