Extracted

• • Target
    cyber1.bat
  • Size 163KB
  • SHA256 e1d1bb243e61dc3f29989264dcffd0db429bc4df484addf37f4cfb84dd33ab1f
  • MD5 9868a6c4e66088f6f9d1e83e6542e091
  • SHA1 e5378a2fc0268e149b0d823429e02199eac07121
  • SHA512 65b1b4ab2beebef5eb1f48453e817aa462967c4d9d71777307f82d81ac400fd17e481f7622486ba047100e1f614d9cd74b4bedb3cdad140bc04829672145b3f4
  • SSDEEP 1536:BKQK1v2QxmugjjmF37TstjilBvaRoCUa2El07z6eNt:00IPgjm3JBC5Ua2Elaz6e/
  • TLSH
    T133F39E58A3DDD40752ECF6A40FDB37D7C663A8E47A6113427CCFD3611A8B7A0A5D088A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2