Extracted

• • Target
    Request for Quotationq.vbs
  • Size 156KB
  • SHA256 11ba24ad254c853ac33d8f3ab1b01f7d5657b5cfc65e55d7dc9c7a62da5ab868
  • MD5 7ab1c6a02836d6c88cd11ba40835f0a3
  • SHA1 1573e0dc0bc8dc91791b391dd65e1c1a83497313
  • SHA512 398d9ec8934f32a1d119518be865b1b777312b4724fdfcde6c8dea08334b41501276880a38afeb4a452e68dbaad7393a351557b0a773db3cf23596fa27f33c8e
  • SSDEEP 1536:qfyOQYbUMZg5VDt0ags6ga3k62B4wRR36lVC6QNUh8b06aEhjGCkWG3FiyKICcG9:qd4MWDt0ByGkw46nKbTZSWG3YyKIi
  • TLSH
    T1C6F3F9E5CADAFEF29EF7EEEC03557B87996D0B270D2071034A14D10CE9AB329459CA50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratpersistenceratsuricataadwareransomwarespyware

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2