Extracted

Extracted

• • Target

    reversheshellb64batTO.exe

  • Size

    88KB

  • MD5

    aa8d4f9a7cea9c7c8de61478ae5a7f81

  • SHA1

    5b8ce5f94b702731877e55822dfb505af4332fa6

  • SHA256

    cb89e6fafecf411a75df6cb06b2302e8f3c9696232dbdff6b25b3d6bec635c91

  • SHA512

    2f54a16ad0a7a0ec8c6ea4f08cd28c587a6ac29421ec1433150e80e164d48bdd312480a86b15477deee4e11f3cf331823400a9fc858451fc4eaf59213577c982

  • SSDEEP

    1536:D7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIf3xP+:fq6+ouCpk2mpcWJ0r+QNTBf3B+

  Score

  10^/10

  discoveryexecutionasyncratdefaultrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2