Extracted

• • Target
    نص.bat
  • Size 142B
  • SHA256 673414e3408be68396c525894939b2a52251db445c121c84fd6c8f293b779b5b
  • MD5 08872530746ac4a76f6fa4eae82df435
  • SHA1 db0962e8ad120e75d2f8bc48db8cadfa7f03bfa4
  • SHA512 fc165f36f460e8504dc9223528439a931c0cb8f4dae26a370b06466ce0b913e87f114287ae8fbd4a82409bb042f4ad142ff10469d3be88261161cbaa0ee0e8e0
  • TLSH
    T1FBC02B765424D3E81C47AC3A2CDD857A112F205B4332CF83B2209724098114C820074B
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executiondefense_evasionmasonratrat

  • Family: masonrat

    MasonRAT is a Windows RAT written in C.

    ratmasonrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion
  behavioral1behavioral2