Extracted

• • Target
    SCAN DOC FILE PR 000100265.QB-.js
  • Size 396KB
  • SHA256 ea326b9f3adb615c5b8a6c89288227ece1d29fc30dbfb4500d98c15c33bed6f5
  • MD5 fc8e887dd140b4b7775f1ab374de42cd
  • SHA1 c8397dd8d76bd715f479acd5c745bbc741c6c760
  • SHA512 086b6793a7f4dd103f178172996ea178922c5cac2776c7df5684376060daf90c585764d29538b170db60e23ab98ee95c6c29a3836d3de3643e8f421d4b6848cb
  • SSDEEP 6144:DO0Ms9CFVmJ7QAy/zirFhFQlH1RpQgaQ2PakWr5QXHweR:6iCFcE/ziZQp9wQ2tK5QXQm
  • TLSH
    T1EA846DC791A69B527F0878CCCD0B67DE6D38B99D97C975F03EB643247614C2204AB8E4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratsuricata

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2