General

  • Target

    ddQ0NeXp.exe

  • Size

    47KB

  • Sample

    201229-wfyp5hnxvn

  • MD5

    15613db46bb33f6367617eba4044ae57

  • SHA1

    319c1258c81255da9966085abf247b0a98b04534

  • SHA256

    82e765d576749be75f8eec64ab5cb4c934b494e30a74fc9a4f70b1c8d3cb25ef

  • SHA512

    801b753b7a0cec54a3c4559e280218600bbd1b35532524cc1590028a522a2d7a1cc466617468b6026249e557a3e9c9fb51ffde151f047f298853e4187bfd34a4

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

212.125.28.114:4096

212.125.28.114:80

Mutex

Chrome

Attributes
  • aes_key

    1CnLzdFKeHMvc73LklvNfF9lGOtqdhb9

  • anti_detection

    false

  • autorun

    true

  • bdos

    false

  • delay

    Chrome

  • host

    212.125.28.114

  • hwid

    3

  • install_file

  • install_folder

    %Temp%

  • mutex

    Chrome

  • pastebin_config

    null

  • port

    4096,80

  • version

    0.5.7B

aes.plain

Targets

    • Target

      ddQ0NeXp.exe

    • Size

      47KB

    • MD5

      15613db46bb33f6367617eba4044ae57

    • SHA1

      319c1258c81255da9966085abf247b0a98b04534

    • SHA256

      82e765d576749be75f8eec64ab5cb4c934b494e30a74fc9a4f70b1c8d3cb25ef

    • SHA512

      801b753b7a0cec54a3c4559e280218600bbd1b35532524cc1590028a522a2d7a1cc466617468b6026249e557a3e9c9fb51ffde151f047f298853e4187bfd34a4

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Async RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks