Extracted

Extracted

• • Target

    ORDER-2560086-456442.js

  • Size

    7KB

  • MD5

    712b3d797cc7ff38b303626bd4c46820

  • SHA1

    230960fe0aa5dafcc6b8bfa8dea1e8c8bbec48b4

  • SHA256

    a313e0c456b2f0bc4ae15dc052990adf4084cb5bd1585fa55c1fb2d07e031539

  • SHA512

    3f4418c32c9671e21ee5f4a90c98edb5d8136586428949e4d60fd72ba0636af4732a474f739e7bd9fc984c90426fc18ac0a45c0a4179ec241e1e87023657f80d

  • SSDEEP

    96:I4MNAzR3AdipeySwCZg9YM0w0IFA58kf69wSXg0MwrwUavwDeUwnywdwc5wU9+V8:k8ZXpekLai069i/AymcpU0wgb

  Score

  10^/10

  asyncratwshratapr-25-2discoveryexecutionpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Wshrat family

    wshrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1