Overview

overview

10

Static

static

faktura 0975.doc

windows7_x64

10

faktura 0975.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    faktura 0975.doc

  • Size

    3KB

  • Sample

    210415-1w8ayhdjvn

  • MD5

    62f9b4a0d977292a757f209c10d07c59

  • SHA1

    2a10128913875339ce33a7790a8afc33299a651b

  • SHA256

    81e9b0a91e38aca2347fbd1812c95be2e04a31444629244e1f7a64b84fec45e2

  • SHA512

    e10369cc642b7af06d1c5ed8a32d3c52fb74dc5efac4b2d6bf6a63c8b4d144507d59c04e1df620b781780c55d3340ae16ba06f36a1a8cd1ac2c2c5f9e418decd

Score
10/10
asyncratrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

217.64.149.183:1975

Mutex

AsyncMutex_6SI8OkPnk982

Attributes
  • aes_key

    HT9s6QmpqjJcWPeFvj9lPIjlcLXMQsOe

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    Default

  • host

    217.64.149.183

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk982

  • pastebin_config

    null

  • port

    1975

  • version

    0.5.7B

aes.plain

Targets

    • Target

      faktura 0975.doc

    • Size

      3KB

    • MD5

      62f9b4a0d977292a757f209c10d07c59

    • SHA1

      2a10128913875339ce33a7790a8afc33299a651b

    • SHA256

      81e9b0a91e38aca2347fbd1812c95be2e04a31444629244e1f7a64b84fec45e2

    • SHA512

      e10369cc642b7af06d1c5ed8a32d3c52fb74dc5efac4b2d6bf6a63c8b4d144507d59c04e1df620b781780c55d3340ae16ba06f36a1a8cd1ac2c2c5f9e418decd

    Score
    10/10
    asyncratrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks