Extracted

Extracted

• • Target

    ORDER#25320789-408AC.js

  • Size

    563KB

  • MD5

    ab0dac9d1b9b83383dbc5d469d5fa1ae

  • SHA1

    b15b24f82ef0a07fce5b7c2735d8a8b46b547287

  • SHA256

    398e3d3d2ad8e2e91693c1682780d2352ebe962b67547af5c20735ae97ea94a9

  • SHA512

    66829799b8233f142aa1420f1e2dd4dfbdc3f2417279b12481d87612a0d97add61d819e58c369818ac201a4ba568e92d5fcd4b9ce17fb68332eeb5718f2f72fc

  • SSDEEP

    3072:MCAFTI3Ws7WZ4hRPhts7YRw7Xx5FzNM6x/P0UHD2yQ/ry:MCAFs3F7WZIhe7nbDIxu

  Score

  10^/10

  asyncratwshratmarch-25discoveryexecutionpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Wshrat family

    wshrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2