Extracted

• • Target
    mko2.bat
  • Size 159KB
  • SHA256 f9cec720d0aeadc2435f7947b5cdcae2dc4deedbb610ece5b81784063f769628
  • MD5 9e2c7d3ce908d859c62d933e0d4c4c64
  • SHA1 6adea299df7895005b7e1cc8cabc42831379edd5
  • SHA512 43e519a4bf14c5247103702cb1f483eb634504bf2d0231103df0d0c8910ae58f7a7454fb131a7853aded8b16cdd70461109836953f4f6259a8f71375763fe532
  • SSDEEP 1536:BiW+S7s6O7rlwti8K6AEigIJoXbI8fcv6h2VUnjz0cx30IRrpWk:BiW+SI66lp8K6Lig5b5UvlY5VL
  • TLSH
    T150F3B0A3F77C397C35149EECC2AC6E84668959FB0FE1D01A4B9031731EE74692E68472
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2