Extracted

• • Target
    ORDER CONFIRMATION JU142026-771PL.xlsm
  • Size 174KB
  • SHA256 0d39da93c95bc61bf717491072f80ea5e49692ae0537bdfb3829e5875c64bc97
  • MD5 185ddd1e558ce1dd791bbb1314f490e4
  • SHA1 8a2686d3d74963bc528a8e8ce8b26892dd4c8bb1
  • SHA512 9e064a41d303504ec302dd071d05e36168b13bfb8a25795913c5a6a8e913c1315bf27ad267cba03f5f652b4cfaffc9c811e2f0aa2602761333b2346226d1c650
  • SSDEEP 3072:MmKCQxgMtst3xO1wsvubsJl6okEAp1amW6ZLEIhTDI:a6Mtsbuv4sJl25pcAT8
  • TLSH
    T1390412A7987ADDE5EEDC1C39F38DA17694437A988106324FB2E493383361C53758228F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratratsuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2