Extracted

• • Target

    9491700097082_20250101_20250211_40489.vbs

  • Size

    61KB

  • MD5

    6b21159837ddee24c19775ca1f5ec62d

  • SHA1

    d68d6100363fd75679c69111288d9fa692b35cba

  • SHA256

    1bf0f448a3723866f225527bd1cae2d5062ca48c298b425c11968b4bbddca5c8

  • SHA512

    2633084c9bf5db0e2f241a33692ce9069ba04fa72c5b8d7cbdb1573f469b039cf1d99836fe21cb5eef0cc7744ecbdb6f1dcdee82c88c851aaa10e5293a8ac023

  • SSDEEP

    768:e2ysVepqc8QaEiZ7LfrPBW/2Vbt804sXcYpr6qDaR2UjKWlAi4fKds8kzB6oerlN:m9a5bBvVbu04s5CR2lWiIAwltrQRFY

  Score

  10^/10

  discoveryasyncratvenomratfeb 19executionrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2