Extracted

• • Target

    6b77f5653e677200c58e8b184676d5b32ab551cfcea76a87e227c1dbdeebfc19.vbs

  • Size

    6KB

  • MD5

    f7f8fe92731aff901ca5f2383ac1a13d

  • SHA1

    961e1819e8c63e8fcfd9100e985ff30d7e112e9d

  • SHA256

    6b77f5653e677200c58e8b184676d5b32ab551cfcea76a87e227c1dbdeebfc19

  • SHA512

    2b1baca6c86fde32dcb81b60f717b3567160ca9417119b66ff7904e0f49cb60ca16c5820f550ee7e3f07440e41b40cd8adbcf65d5ba71e6249079129ed60225f

  • SSDEEP

    96:egvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvbRvt:xLPjGZOmyX1

  Score

  10^/10

  executionasyncrat00000001discoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2