Extracted

• • Target
    stage1.bat
  • Size 156KB
  • SHA256 b5927f4bdf344e56ee51a6d78d3e917fa4465d747070e2960b8b90e12ef19d1f
  • MD5 c126c9c69029d0d25af8380c5eb3b4a1
  • SHA1 650f2b76f4e79f23ace15391d0f1b2fc27a8a413
  • SHA512 3cb6af88d3d50cfbd3677527b94f585d6a7b988402d30dd5c3ec7241a8601d061381e044379dc6a3205c1e9228e0ee38ab72a8195f699d837990f7e75fbb8698
  • SSDEEP 1536:RwnajbZGw5ZqHFeR33ixmKlnksbVRw+QiYceHm9w/8:W4ZqHF633iMs9w+dYceHm9w/8
  • TLSH
    T1BFF39E62738724D55BA7EA684D5F4A06FA9BCEC1167AC4D2DC49F6270B3B1038B83C71
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  nulldefense_evasionexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2