Extracted

• • Target

    d7f99feab000b2e540484c9fd595581d95eef7d2cc34da759293d5ef51961928.ps1

  • Size

    463KB

  • MD5

    4dd31f8ca34edd7fda06a1823b19870e

  • SHA1

    711a9b63d7b57d914496093438e945557a1157dc

  • SHA256

    d7f99feab000b2e540484c9fd595581d95eef7d2cc34da759293d5ef51961928

  • SHA512

    63cc565e9657ca21b29b21aed9307b1d544638342abf4a8ce5fa2fe0268d6f9751aa4801fc1d0476a9069dc67d7c2be1423ab365ce921a54c9fafc0a88a1780c

  • SSDEEP

    3072:xL3+PE+NPVFL2bUCUrNlKomLJVlCsspSljz:xLoE+NPVFL2bUCUrNlKomLJVlCsspSlv

  Score

  10^/10

  executionasyncrat00000001discoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2