Extracted

• • Target
    IntimationReturn.vbs
  • Size 4.3MB
  • SHA256 93a180ec5678568b9d071861338cc3572ac8c95cba3f7887ab597565c722602f
  • MD5 9ebf0e1a54cdf15a4bcfcbfbdc12958f
  • SHA1 3b750cb6c9f401ec5780ae615552be53f879d373
  • SHA512 93298eab5a66131378edafc1216e791292f0a3154c648b726b7d5a01da9d36fe4649db92c1803a9baeec5332afd6d7732a07517699e00bc45892b484dd820752
  • SSDEEP 24576:UzyEQIEATJ9N2sO4sKps6CT28TSo3pLCym7hpxZU9xfARdKVKm32XsEdfQAxDKvV:TBn
  • TLSH
    T17B269F606E5859F5EF8C6A0E90AE6F1D87F042176A33706BFB41DF04BD9A341864B21F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  stew fresh 4defense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistenceratsuricata

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2