Extracted

• • Target
    S5121000221100211-110211.js
  • Size 41KB
  • SHA256 89d17353a10865a0c43e3c32e767d7829245df954fdceaa44c1d0fda84a8f7d4
  • MD5 c66a6c361c9c1de575289e4895784474
  • SHA1 d465accc78d930abf4e4d496c7bf74914f2b02e4
  • SHA512 5641e29bc6057f4bc940899dae529b63ba95ae75a8369c3327d75ee774f8f5796a31432307c98ea3cb2b2a9e6b0a1de867e81dca682904242909116e7fc90787
  • SSDEEP 768:Cnc/Re/e/e/e/e/e/e/e/e/e/e/e/e/e/e/e/e/e/V/scZ19llF1bSQUg/o:2sR++++++++++++++++++VscZf/F1S
  • TLSH
    T155137916399FC61871A24689469F07754B6F794F1FBF8089048EEEC98FE34225C877A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  stgdefense_evasiondiscoveryexecutionasyncratpersistenceratsuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2