Extracted

• • Target
    APIE900120226C06565SD20A23.vbs
  • Size 1007KB
  • SHA256 38e0026010b716a32c177b580204231f57153f5e5c4ede4547bb2b4a9a7c3708
  • MD5 2dbf746c1a4dc39dd05f551e80184567
  • SHA1 924bb91589a20d776db8c54bcfafe3c16276ed85
  • SHA512 16c9f454d3a886fc1dd00592c539a426bed4dffdcf29afe609d1a75696282a39900d90d89f553be33156aa3ad290f32cb3b3f662280b6c1fb18eaa450631acec
  • SSDEEP 192:dR0+++B+++B+++PKRo7iOcT4b4NOSoZutKFIbDl+++P++++P++++P++++7+++P+0:pVmT4sOSoAtK0p
  • TLSH
    T16C25BE402C7BC009782EE9A1269F2D61D7349924BEDE7BA4FF06505527568B0EB34EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  nuevo2026defense_evasiondiscoveryexecutionasyncratratsuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2