Extracted

• • Target

    winjs.exe

  • Size

    52KB

  • MD5

    623a97bc746f3b530b9f2cb2df7e9145

  • SHA1

    1c03bf8e9db2120a1473c9c6924059e75639fa1c

  • SHA256

    fe0f056142303bda8538355d81aced08b4792c9787c6060ccad08442e0dacad0

  • SHA512

    c0b89b096704a2727bf0242b2d20ed563980e51c4535cac98a9a34d84e89289bda87e3763bedb615f04f72d18a502f48b8ad5276c9e8dc4d1373e1a0bd47ff52

  • SSDEEP

    768:YoGDMmILyCe++bidiEuiso8Ybwge9V2COvEgK/Jn2i++++tyVc6KN:Yo0MWSMEzb3mOnkJLyVclN

  Score

  10^/10

  asyncratpowershellrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2