Extracted

• • Target

    ca9af3c4717ffe322f5e2f02fc8745f5744f5e8397a87212246099b4c3e2a53d.ps1

  • Size

    456KB

  • MD5

    067e3f77fde1c988ac1d1413bafc29ae

  • SHA1

    e2a17181441c1e573a47d7ef8c259bf9797be9e8

  • SHA256

    ca9af3c4717ffe322f5e2f02fc8745f5744f5e8397a87212246099b4c3e2a53d

  • SHA512

    740bd6be6b4eaa189b596abd56eb9fc48b7c7c31b7fb6990ca27c2ee4e2174a9a1e95b4aca2415b4ae59a3b358cbe12b23a44e145fab4fe7b8cdf4a2d669427f

  • SSDEEP

    1536:g9dW/z20+u4dXNR8WrlDnqIuH7FWRGPP3jU86lsWST+HxYfn8qgy5J+LLg7WMJV8:gzaGD

  Score

  10^/10

  discoveryexecutionasyncrat00000001rat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2