Extracted

• • Target
    IntimationRefund2024-2025.vbs
  • Size 4.3MB
  • SHA256 c65f05b9f92b5d1cc2d19cf9f8d12fad263403d54952be88f93cd65a54239a5b
  • MD5 3c65ccef988e27a2efc27cb11f31eafc
  • SHA1 9e95e95127a0ddd1257976eda1dfb1582f9fd952
  • SHA512 ffdb664bb644a568b694ba174da9cd6aa0167763f2a92d273a40194f031cafff01939e03a77c52d79d938fe9bc3ee7b53e53a5f95dddf9772093b30ebd2478e1
  • SSDEEP 24576:KrSVzHwm9MNo2bsO4sKps6CT28TSo3pLCym7hpxZU9xfARdKVKm32XsEdfQAxDKM:mB+
  • TLSH
    T107269F606E5859F5EF8C6A0E90AE6F1D87F042176A33706BFB41DF04BD9A341864B21F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  rediffdefense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistenceratsuricata

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2