Extracted

• • Target
    BS21110088121812100-00111.js
  • Size 41KB
  • SHA256 76f86c7176b7d4df360bdcaf40864f40b148f841f95cd290ec017a7210a8a0ca
  • MD5 d51c233871763eeddd166932c3362146
  • SHA1 f528f8c6b9e2315bc3efdfdede4a46a6d249f395
  • SHA512 43ee6b38b985c6f29b01cfe2f345a77c1159389104e71206119e1317e07be5b9fdf85df959fe66ae293971f39f31442b90277e8fbd14ba58fb09880953c12cab
  • SSDEEP 768:pn+lRelelelelelelelelelelelelelelelelelelVl8gJ19llF7biSS5TR:pQRwwwwwwwwwwwwwwwwww38gJf/F72
  • TLSH
    T18F137816359FCA1871A282894A9F07B44B6F796F1FBF41C9008DEAC94FD39219C477A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executiondefense_evasiondiscoverypersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    V00021181002110001-000211.js
  • Size 41KB
  • SHA256 5f781a4eee2109967ee725544ba7cb0a23d2bf89d1402e8992ecdfcbcfaf4bd2
  • MD5 0368d30ecde72a944a1f503cd163adf1
  • SHA1 90190a557cd86cdb711bdb536e3359c67fd6f7f0
  • SHA512 21e221da920fb36bd5d7604daf97c06c64b677dc540e2aed0fdad9832d198dbb9e0344d8c4d0a876fc622e0a7e7d93cd4d2ac30ea5f629c3a195d2a1dfca49c5
  • SSDEEP 768:+nWPRePePePePePePePePePePePePePePePePePePVPw9E19llFwbdljGWE:ieR222222222222222222Rw9Ef/Fwo
  • TLSH
    T1E5133712759FCA1871A2478A46AF07750B6F795F1FBF4089008DEACA8FE35218C577B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  stgdefense_evasiondiscoveryexecutionasyncratpersistenceratsuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    V2221000552100021-211021.js
  • Size 41KB
  • SHA256 db6955e8a069e420a6a1ebc007eda6ec740479968195d79f4511e8eeb98873c6
  • MD5 d07d1ec0a6a1594dcfed9c7fc20b5c17
  • SHA1 5c8d42868479278a792dfe9e1ae9c594c0eb69e9
  • SHA512 07dcd4c2250aaacdae5fd51fd53c586f6d13c33da91bc5ce8c58b71315a5caa6d91eea9ccdbd4647338a4bf20f3419952c1f566c4dbbeba24f13e6914f3a64bd
  • SSDEEP 768:knWyReyeyeyeyeyeyeyeyeyeyeyeyeyeyeyeyeyeyVyczW19llFBb1VZBF3:4TR777777777777777777sczWf/FBV
  • TLSH
    T1FD138616358FCA1471B2878A4A9F03744B6F395F1FBF0089058DEAC94FE35225C977A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  stgdefense_evasiondiscoveryexecutionasyncratpersistenceratsuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    W2000011853108822-5121004.js
  • Size 40KB
  • SHA256 1c9a5adb16ff2457942ee3b133b2241e8768b1c3702deeae67e6c8c09136bcaa
  • MD5 9b0932a43c8f7aee62d9d611defafcc0
  • SHA1 96b50fac386af7a67e057cc5520bc3dd61b3f95b
  • SHA512 a8e2db3b4cd17ae4ded602fe3a22f91ebf8f622399c85ed1850118502bbf3552d0855f3eea3cb3c07620bebb4c763b94195632108f0bc5c718a903ef3bc80023
  • SSDEEP 768:RnWgRegegegegegegegegegegegegegegegegegegVgAVE19llFbbkyp1V9zyd:RxRZZZZZZZZZZZZZZZZZZGAVEf/Fb5zo
  • TLSH
    T1BB137916769FCA0431A24A8A4AAF07750B6F799F1FBF40C9008DEEC98FD35115D877A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral7behavioral8