Extracted

• • Target

    d28c3371542ec4275020001c02ae26f41d0a11109375cffee6d22f56b9fc5259.vbs

  • Size

    98KB

  • MD5

    33e243596a995b134c3862d2746d3a3a

  • SHA1

    dc51212190c79cd89cfb6a629e3f7299673fa003

  • SHA256

    d28c3371542ec4275020001c02ae26f41d0a11109375cffee6d22f56b9fc5259

  • SHA512

    545089424ea61e9c3871a75170d8695331bd991bf7fe8d10a5dd9a136db8b2015f9083faf86023c751550a9faa44ceb6ebfe5b6ae2d593d4261678eaa5a739c5

  • SSDEEP

    1536:PxfjFMLSEGgcX4XTA66MrhZLVzsBjuBl6D584BuvQNkHGwhJiz1U8x8x0yCzkIXG:PxGfjjLVzsBKB+uvNHTAaw8CyWVG

  Score

  10^/10

  discoveryexecutionasyncratvenomratmarch logsrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2