Extracted

• • Target
    serger.js
  • Size 369KB
  • SHA256 54217b596500752e66346f02e74b5efc165e9fa15e63edbc102096f738bc4514
  • MD5 6a9eab720e02ce84858ee30c3b4776ba
  • SHA1 c5e2562ffe8fd0fbe88631788575ed667f437d5c
  • SHA512 9ff657e6f7cfe6db5edb65aadeb4f9e0615705ad2207dd575bc686e3d2b680feb44b7e20f10d7497d90e0951f211891933c121d8926d6955a05e0495277e1850
  • SSDEEP 6144:FGiWC/EboFYW58dht/yZSDLAuSLBw/ikBSIOhwlxsCtNSDEoi/k:FC2EboFYW58dht/yZSDLAuew/iksBhME
  • TLSH
    T1F384F9FCD611ED53A207B73EB3C9E85420791B52898FD8CB50BC12FD29E6900B679D86
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2