Overview

overview

10

Static

static

sz.exe

windows7_x64

10

sz.exe

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sz.exe

  • Size

    10.5MB

  • Sample

    201224-npw4mbbby6

  • MD5

    a84b3b7ebad4e58b005fb502e2765e04

  • SHA1

    9ac61b73f987b7d815ca8d06a6e064dcd4d6f849

  • SHA256

    c397eb85439a20b9185e001ec8cd286281d27d6be336d32e93558e451e6aeeeb

  • SHA512

    dab4984405ae8092354d4232c71eb454f86111b12116674aed620d00561e3ea6dbd3798bda14fe755a7a2d45896ed32dd763fdff3711b7cf0cb94763107ed135

Score
10/10
asyncratpersistencerat

Malware Config

Targets

    • Target

      sz.exe

    • Size

      10.5MB

    • MD5

      a84b3b7ebad4e58b005fb502e2765e04

    • SHA1

      9ac61b73f987b7d815ca8d06a6e064dcd4d6f849

    • SHA256

      c397eb85439a20b9185e001ec8cd286281d27d6be336d32e93558e451e6aeeeb

    • SHA512

      dab4984405ae8092354d4232c71eb454f86111b12116674aed620d00561e3ea6dbd3798bda14fe755a7a2d45896ed32dd763fdff3711b7cf0cb94763107ed135

    Score
    10/10
    asyncratpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Async RAT payload

      rat

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks