File name:	sostener.vbs
Full analysis:	https://app.any.run/tasks/187a07d6-2d86-484f-88ef-647279957bbd
Verdict:	Malicious activity
Threats:	AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Malware Trends Tracker >>>
Analysis date:	November 21, 2024, 00:08:56
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	pastebin rat asyncrat remote
Indicators:
MIME:	text/plain
File info:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
MD5:	8B2A9F06F264DCA6CCA8E8B2B89D8F89
SHA1:	26EC268A64C8966DC6B5BF68E13069CBDEC17EC6
SHA256:	3FE70921BDFA0F64ED04BAC6A793050F8F5B6C97DD0DCB9E1CAEECA8E557FE0A
SSDEEP:	192:2lyUdV8ZvsBef7e3vtEMUETN9Bgv/nMhAypF4XMJV3nQ:UEb7SOE9E/MhAMO6VA

.txt	\|	Text - UTF-16 (LE) encoded (49.9)
.bas	\|	Nevada BASIC tokenized source (25)
.mp3	\|	MP3 audio (24.9)

PID	Process	Filename		Type
6404	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_teiq23p3.2xv.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6504	powershell.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive		binary
		MD5:BEF635445A2939DCD3E2F880BF76CDD5	SHA256:54A5BD3EDEDC7934A899BFFE688CB8798EF30E79D37E14D8DED0E7BCA832CE91
6268	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nuss1kkf.w0e.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6504	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tmoha2ue.fmd.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6268	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dtdkn4mg.yxw.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6404	powershell.exe	C:\Users\admin\AppData\Local\Temp\dll02.txt		text
		MD5:049E0F5996FC5B5152C00BF2F4673AD7	SHA256:1163CF01EBE91124AC0393C2B2731FAB3DF03CDB9624507761D89A7D186AEA98
6504	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_00asieec.jfq.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6404	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_41ilbkrv.cuz.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6404	powershell.exe	C:\Users\admin\AppData\Local\Temp\dll03.ps1		text
		MD5:727D18A699A1CC630AD9DFBCC98C18F4	SHA256:A56A92304915EE21AE36CE42ACEC22F2D7B981E4CBBBD08CDD6AC47618AB3086
6404	powershell.exe	C:\Users\admin\AppData\Local\Temp\dll01.txt		text
		MD5:EBABEF29FC49A8A7A03E3AC91EFD1657	SHA256:BB35ACAA5037ECB77192C480B4634559940D57D5064FD4176C1C68DC6AE11B71

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	2.16.164.9:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5064	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
6588	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
4712	MoUsoCoreWorker.exe	GET	200	2.16.164.9:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4712	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6588	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
1176	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
132	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	whitelisted
—	—	51.124.78.146:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	2.16.164.9:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
4712	MoUsoCoreWorker.exe	2.16.164.9:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
4712	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
—	—	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
—	—	2.23.209.133:443	—	Akamai International B.V.	GB	unknown
4932	svchost.exe	51.124.78.146:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5064	SearchApp.exe	2.23.209.182:443	—	Akamai International B.V.	GB	unknown

Domain	IP	Reputation
crl.microsoft.com	2.16.164.9 2.16.164.49	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
google.com	142.250.74.206	whitelisted
login.live.com	40.126.32.138 40.126.32.68 40.126.32.136 20.190.160.20 20.190.160.17 40.126.32.72 20.190.160.22 40.126.32.134	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
go.microsoft.com	184.28.89.167	whitelisted
settings-win.data.microsoft.com	20.73.194.208	whitelisted
pastebin.com	104.20.3.235 172.67.19.24 104.20.4.235	shared
firebasestorage.googleapis.com	142.250.184.202 142.250.186.170 142.250.186.74 142.250.185.138 142.250.186.42 142.250.185.170 172.217.16.138 216.58.206.42 142.250.185.202 142.250.181.234 172.217.18.106 142.250.185.106 216.58.206.74 142.250.186.106 172.217.18.10 142.250.185.234	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted

PID	Process	Class	Message
2192	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Online Pastebin Text Storage
6404	powershell.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to connect to TLS FireBase Storage
2192	svchost.exe	Misc activity	ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee)
6504	powershell.exe	Potential Corporate Privacy Violation	ET POLICY Pastebin-style Service (paste .ee) in TLS SNI
6504	powershell.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to connect to TLS FireBase Storage
2192	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2192	svchost.exe	Misc activity	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
6752	MSBuild.exe	Domain Observed Used for C2 Detected	REMOTE [ANY.RUN] AsyncRAT SSL certificate
6752	MSBuild.exe	Domain Observed Used for C2 Detected	ET MALWARE Generic AsyncRAT Style SSL Cert
6752	MSBuild.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

General Info

sostener.vbs

8B2A9F06F264DCA6CCA8E8B2B89D8F89

26EC268A64C8966DC6B5BF68E13069CBDEC17EC6

3FE70921BDFA0F64ED04BAC6A793050F8F5B6C97DD0DCB9E1CAEECA8E557FE0A

192:2lyUdV8ZvsBef7e3vtEMUETN9Bgv/nMhAypF4XMJV3nQ:UEb7SOE9E/MhAMO6VA

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Bypass execution policy to execute commands

ASYNCRAT has been detected (SURICATA)

Changes powershell execution policy (Bypass)

SUSPICIOUS

Probably download files using WebClient

Probably obfuscated PowerShell command line is found

Starts POWERSHELL.EXE for commands execution

Application launched itself

The process executes Powershell scripts

Connects to unusual port

Potential Corporate Privacy Violation

Contacting a server suspected of hosting an CnC

INFO

Manual execution by a user

Reads security settings of Internet Explorer

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings