Extracted

• • Target
    RefundIntimation9387943.vbs
  • Size 4.3MB
  • SHA256 ee9918abc39d7d0b46c5cf7891f5b845d0ae5acc0e88f22ecd6ad19099260651
  • MD5 c39c47ddef43b8bf7807d1c687bb96d3
  • SHA1 07d5555319bf035603ae336a6c6876ff6deb8dd9
  • SHA512 f4cacf38536f86685f4e72ba53eb78d9ec9abbb70a434adf13c4dc8ed836168f78dc2b9c5c0f8d7fdf96395593c5eaac0f1900832e8364a1515dd3a60befc19d
  • SSDEEP 24576:t/ZWLuefCM8p0jgLFmAJUO5IrsO4sKps6CT28TSo3pLCym7hpxZU9xfARdKVKm3d:4BH
  • TLSH
    T1F5269E606E5859F5EF8C6A0E90AE6F1D87F042176A33706BFB41DF04BD9A341864B21F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fresh 17defense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistenceratsuricata

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2