Extracted

• • Target
    ITRIntimation24-25.vbs
  • Size 4.3MB
  • SHA256 b7330cf42457ba3a1cb515d260f2fb3f4dd90e4de9cf26fd6b070cf53109df6d
  • MD5 dc8f595456e314aff3efceb55f72f74f
  • SHA1 e02d982f78d80925324a2c72dde90a365dad8371
  • SHA512 00bc5ca618efd4fb6109b3207e1aabd750a7ac0a805d05e4e5f085d8e1fd0da67422cb599142c397dbab5842d9f35948dde20cd9b7675bead6d5caf10e17b100
  • SSDEEP 24576:t/sffqbNv51KUiAsO4sKps6CT28TSo3pLCym7hpxZU9xfARdKVKm32XsEdfQAxD7:drBI
  • TLSH
    T161269F606E5859F5EF8C6A0E90AE6F1D87F042176A33706BFB41DF04BD9A341864B21F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  major reddefense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistenceratsuricata

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2