Extracted

• • Target

    06c0c2bfc88f5e4b30de9b11c8c7995123d5366503a83c4fe45f6458164e4d43.js

  • Size

    7KB

  • MD5

    8016106a0f300b92e1228bc05c27bdd1

  • SHA1

    10035c10b4d8fe09868675540f59fa1432aa0ee0

  • SHA256

    06c0c2bfc88f5e4b30de9b11c8c7995123d5366503a83c4fe45f6458164e4d43

  • SHA512

    1625dc364ae65ecb3468823f51ceef4013e5cb938e073a08bff228c7a03a158868780455faac25788720ff43a27786d59cefdcddeb1cc9aa732a19cf9b061627

  • SSDEEP

    96:0SloqevS78QHjtM787Ljr7wetMkejf8QHjtMTpOcfObeqfOb/77XpGaq8QHjtMqH:kQ+tofSP6l4rF

  Score

  10^/10

  asyncratwshratmarch-25-3discoveryexecutionpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Wshrat family

    wshrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2