Extracted

• • Target
    Rian Pending Order List.js
  • Size 5.2MB
  • SHA256 11b98593366ff6a3b4d3be660b9ef4ff3db9792360f74cb81c5e30ea1d7f35e4
  • MD5 6277a25fcf38ec47bab4f591fce3f27d
  • SHA1 d5c6d5d831aeeb8ce755879169619ad169158844
  • SHA512 b83eca11fef7991aaf2e395348d1e52e8378cfaf74615b6ec75cb1146b63806a6b96f8f2863c9d42c90b8cadc197eace6837550ff2b305d12f2dbd0e4c10a2fa
  • SSDEEP 384:ygJxkfrkWmad6laP69EUzXki6b82GuR1rApwQ6VE6T0r4i3ldUaUtNvPMG4ph96A:6yI0p
  • TLSH
    T132465F3871EA07242F50F8C50E1D3EC342AFF449E2B55BF99B277C7852164983ACD9A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryexecutionasyncratpersistenceratsuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2