Extracted

Extracted

• • Target

    ORDER_253890-5645FD.PDF.js

  • Size

    535KB

  • MD5

    930368ea6f7cd3ed52e3c11ce5a8b84b

  • SHA1

    14205534d961366b4b5650a0bd751366d40e812d

  • SHA256

    890ff9e6467fd6f448189cc6cf0e0f048d116b8fd289cacc6460215702b7b45e

  • SHA512

    5bc116514e447a9edb47c85aa70a2f900241e3920bd8bacf374c78ee6caaa46c4525b7077ca44a69790b21189d48ae74efdd7993db1d728d09c419706c7db629

  • SSDEEP

    3072:vMRy93zMk/wFRTiNy49mDvVHq07vg6fwTuP1c3TS:o82T8UJ7vg6fS0Se

  Score

  10^/10

  asyncratwshratmarch-25-5discoveryexecutionpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Wshrat family

    wshrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2