Extracted

• • Target

    551aa52e13e8dcb3fbfc476d7bd3eaf46ceeaebcffca2cc72b62ec76625be71e.vbs

  • Size

    6KB

  • MD5

    2cac56c224c4fe93c8133ce8997d6698

  • SHA1

    b02d87284e587e5b59af0ed6d984faf5d05c687d

  • SHA256

    551aa52e13e8dcb3fbfc476d7bd3eaf46ceeaebcffca2cc72b62ec76625be71e

  • SHA512

    20565ec2837975a30b2b9bafb92e33082360f34c5ab1c3ce6eba0c138d0af5a4311ef71ee35c6fd845b445aaf5e5746ce17f9b6033019390de2041b53dbb3e4e

  • SSDEEP

    48:edClIClIClIClIClIClIClIClIClIClIClIClIClIClIClIClIClIClIClIClICX:eLPXyTuGZOrHTu5Vibru

  Score

  10^/10

  executionasyncrat00000001discoveryrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2