Extracted

• • Target
    o.bat
  • Size 156KB
  • SHA256 0566f05ffcbe0e80b2a185207b6f5e4659c11e5cda4aff1074d2261c04035b5d
  • MD5 81670900e2e96c3170a989ceef035c63
  • SHA1 17093c6d6cfb912b05997b1bedc696b4bba9aea8
  • SHA512 e78da2f5d33833f8199ce1b8329618517044e4875fad2cbdcf84750c7f7e4d2e6a42f6b2f6c9952fa31f8a9ed9a098749a2784872c6ab56af466d67ed61c86ea
  • SSDEEP 3072:39SHq+abI5226XIrray4fUt4cHokTbQlR4ieFV8AD3aJHjUCSJTeK:3S5HokioCSJL
  • TLSH
    T1A6F39E9FED4F4CF6039945C819F0B4890345B429834D9C18362A7FE5A2FA36EBC06B76
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  nulldefense_evasionexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2