Extracted

Extracted

• • Target
    ORDER 260727-08428PA.PDF.vbs
  • Size 2.2MB
  • SHA256 1488125b386dfbcacb95a6491c6185a0f32e200010911f73a92cecb56f4dd06c
  • MD5 86579a112f3532e57af1274c293770ad
  • SHA1 fe39d5f4ea5f1d3bf5c0d2d987da81cdb7c54a43
  • SHA512 f65d2855c325ed030af993e7d1b5a973bcf2589328ce3fd446c35be45667245452aa3d51fbd51e5f4c61fd9edfc174d61a6544f9ba98608aa1c074083cbd1393
  • SSDEEP 24576:xvXM6FiYYWtpORnMxPbdP1HkicNdqslXrn2M37x/bknIOD:NbWup
  • TLSH
    T107B51895BBEDF1F92FE4174D63E75D4C03C0200EED827029B415691F8E69998C8ABFA4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefaultdiscoveryexecutionasyncratwshratpersistenceprivilege_escalationratspywaresuricatatrojan

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Modifies WinLogon for persistence

    persistence

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2