Extracted

• • Target
    PO 38384948T.js
  • Size 884KB
  • SHA256 a858bfc9d3b5fce53308a43e70d920402a6ade3836ba0ca50c406d00c2c0c6d8
  • MD5 816511a805be5a90637e29dc976016a3
  • SHA1 ac77152428179dde23ac76f25fdf49e43f1a4da9
  • SHA512 753fa8159e9a135a98bd80e3a7ccdd426f6996b9ea86e2e4b94b69bd5f5d2ef31a84e8026f7484e86b3ee4fc1cd37bc764a597a8ec8aa6280a146910503a275e
  • SSDEEP 1536:+wQdnyCyFVT5Iu6fxd4+rl8xNMBX3lRHlyq8Bt8g6yAvlQ1SybF6UVQBoGixTvW6:3
  • TLSH
    T16B15375303851BBDF68D0EC9C94B255B20F2D46B7D251298EBB36EE7BC3B9849430636
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratratsuricataadwarepersistenceransomwarespyware

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2