Extracted

Extracted

• • Target
    das.bat
  • Size 7KB
  • SHA256 0729f408d5386d401f611358b5b7080afc070d352ad0fbbc45df1e901fb92a57
  • MD5 03e091a3c8352836779312e31affb2bf
  • SHA1 de9e064fdf15f17d80d8f82c315ef6813fd0dbdd
  • SHA512 61961c75dd1356c873f421550a3f3e6422e66fa8776b0acd52a43e93e480b69d64fd8112f88d49eb8c8975c1148d0db82e1bc83891a56c32b14e95f6f97d6dc1
  • SSDEEP 192:Lj0SPdPePMPsP3MAtkQ5CXZLocad6o3ZpH5SlvblCYliF7TK:dPdPePMPsP8RpLocad6MkJ9liF72
  • TLSH
    T13EF186052CCA857601F792354F296691FA1D02CB0711E6EE3ADCC0449FBF3E745BADA8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionjan 1[26]jan-26collectionasyncratrat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2