Extracted

• • Target

    8bf17c54ff96f81771b6bd7201d1ccdbd930eec93c4070a9e497f9ed9d8a866a.cmd

  • Size

    5KB

  • MD5

    346f4cbc345012136a9b5d4bfae3c11a

  • SHA1

    6513cf27544946827184cfbf874cf7878aa15aa4

  • SHA256

    8bf17c54ff96f81771b6bd7201d1ccdbd930eec93c4070a9e497f9ed9d8a866a

  • SHA512

    e6b7cca8153d778546ef511dcbe9efef55058e905552724fee5ec9287be5e9c568534975c1c49fbd9972005c1afb647d259fd5b0f762a2c391385f1cb31e4500

  • SSDEEP

    96:PjDPunTNx9TDmGU8OskGh1UF8dB2yVmnzs1sWVPBQetXTXjrC7pUjTioU47aLjLN:vunTNvph8+qz8qpkOqOjLqQOE9B

  Score

  10^/10

  executionasyncratrrrrrdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2