Extracted

• • Target
    https://cdn.discordapp.com/attachments/1544500531630841942/1545632682011009024/JsPayloadBuilder_2.zip?ex=6a9cda1b&is=6a9b889b&hm=afb0e341d27436b71135bbd3f09c96a766d7732515e40ad7d07a9875d73a1104&

  Score

  10^/10

  js-crypterdefense_evasiondiscoveryexecutionasyncratdonutloaderloaderpersistencerat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1