Extracted

• • Target
    A005210080011-210510.js
  • Size 43KB
  • SHA256 f276c0e7432f7aee83e45d60eae2b2d7ba76b8ac8e1be9a69f024719fd31b24f
  • MD5 8877f4dd8c1dce8fff17057767facb4c
  • SHA1 4daa807f17b0b174ceb427626b865c838366daec
  • SHA512 3f165c5556770c933d1473f8ba0197d2d928c42cf528303a2497f7278fb0edc00b38c3b20c0d0a36fb3042688d68d19bf973e4214f2091d766038e3d329a913f
  • SSDEEP 768:VYVbWEEEEEEEEEEEEEEEEEEri7AMNNML5LbZPQFYI3ENcNHNvUj:VYRWEEEEEEEEEEEEEEEEEEri7JNYhqEv
  • TLSH
    T17813A915798FCB1871A256CA06AF17740B6F7AAF1FBF4085048DEA8D4FD352188873B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationtdbasyncratratsuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2