Extracted

• • Target
    POs 2701789 & 2701790.vbs
  • Size 5.5MB
  • SHA256 9da4bc8b16cd1357e2bbb3cb7b976fec1adba9819bce2b0478d593d1cf464e27
  • MD5 7fc2d1c9aaaa04e0522d896f0c63d6ab
  • SHA1 6f56205acae532021ee2ecc87442c90d52319ebf
  • SHA512 e15b2314138eb29da3cdd6090cf8392dd362ffdd9a4740c31c855ef66889ed4eb22e8852dc8d36b6675522b0ff0bd91232b8a69c56b0b72499f090c7304f2618
  • SSDEEP 768:FyABSBv4uAbDJS436Vbpi72Crg5eGrbrm7QKdoUcGQOq+oJVOPCdezI/+cyNIAPQ:a
  • TLSH
    T161465DD252CEE284D9EE64EA54AA17CFBD06395FF9CBD0A006303AFF5271B459E190D0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratpersistenceratsuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2