Extracted

• • Target
    Task.bat
  • Size 501B
  • SHA256 c13d18facc0e46a949845134ac14b8fb26c54e470d2a7fb28463c6b6f05d3100
  • MD5 28826bf56344470c526b670b0b154517
  • SHA1 ec618b2b3b058d6a154ba53a6f1fb14a0f6bfb67
  • SHA512 de3568b3abca649cdc18d587afe84e57008de3ea4237edbc43fb826a89f94ce3423b81f2144eeb7982a4d05136b967dbf94385095eabf6c4207bb39295bfac78
  • TLSH
    T183F09E41010B23C9FA63CA1693CECB588F46E839E3DD052961B94A2BE0A7E24E12C146
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  defense_evasionexecution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Deletes itself

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2
• • Target
    Win-Zip/WinZip Updates.bat
  • Size 135B
  • SHA256 3a14ed21fd2246a9b8e55ff6aec6a1446402024d5663b624f63828bfc43f438b
  • MD5 1df1884e2157fc60e29244ec525cad25
  • SHA1 e3909ba5234c16883c54045e9de98b66e11a61b5
  • SHA512 318b3a4db152d9209634a2c16068d9a86dd9b832ab76d4427acd4715689bc691befdbf247d28f9562b9289c8c5d1e25d2bd2cee19b1a6ffc6533a14d7e8f1ec5
  • TLSH
    T132C02B90111BE394F753CC0C40D5A270481BF000330905C034B00324F1051A1C0DD2CC
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral3behavioral4
• • Target
    Win-Zip/WinZip Updates.ps1
  • Size 254KB
  • SHA256 78069562fd38e3455291ee1a5d8ae939505e79dfbf886402a86dfc02e8ced625
  • MD5 69e6a8acba34fb024abef178dae3f517
  • SHA1 3dd2c727a00edcd4c042a306dca888a43276bf9d
  • SHA512 7f17509b6b78e8eb273a85fed6f923e4225e6e7bc995ec50d63da74bccf4d30fc11e5e8260da2db864df56e0f10a3f8a764fef9592703e00b8bf8703ddef8a17
  • SSDEEP 1536:gcc7KeClkRRSZXgyIMxmVwFZDlDFfMmZK0MiRFCPmgP1b8wtmDUzTLdwc4D0sO8o:+
  • TLSH
    T13844165303851BBDF68D0EC9C94B245B20F2E4677D251299EBB36EE7BC3B9849430636
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  addin2defense_evasiondiscoveryexecutionasyncratratsuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    Win-Zip/WinZip Updates.vbs
  • Size 255B
  • SHA256 4456068bd6514b884ea3699fffa8430fa7047e9f0ab14c038cc422c20f4cad73
  • MD5 b722c6715b5c3bc943e5748e644d920f
  • SHA1 5d062692ed5daeaaccf34f8b99c1829b753a77e6
  • SHA512 235ecd350a6a821d235778e55f6a222efb0de81eae90118d34705791b1f8cc2f5dbc2df060876678c2f9bd358f6f1a00daec121e177723ea133a3ae17deb0be4
  • TLSH
    T165D0A757FC2BC72A539DB99843F0AC59CF09E03C112DD539BED89D76C124E650E6428C
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral7behavioral8
• • Target
    WinZipUpdate.ps1
  • Size 3KB
  • SHA256 f95df7ee97b6be08b252fe66430c44f8e3469bf6b455aca13bd23a15bf88e701
  • MD5 ce6c2072efe4fc8aaab2222abf58acb6
  • SHA1 0327fd654e6dc4cac1c60149ff904caf7a100157
  • SHA512 f76d4c347ac8e80c7cbe2fc61c4f05f7c7a6f4c7ab428305d766329b1163d24ce46f901aec522ebb1325698d0ccd551fb04a0802861aff1ae436c2ce2484ba15
  • TLSH
    T151616A4367EA0108F1F36B5C7EBB14655A67BE516939C86C00E8140D8BF3E62C961BB7
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  executionpersistence
  behavioral10behavioral9