General

  • Target

    5580313788710912.zip

  • Size

    33KB

  • Sample

    210430-1x1ktttjtn

  • MD5

    15c259374376b0e03d962c189321e4c0

  • SHA1

    b6783f79d6d0f5e79d3bb12d6318a678314a011e

  • SHA256

    e7607d2b933b52489c653607019e546bbccfbdf3128f08eeb8b524a6323af34d

  • SHA512

    fa8c2ddf4d60b2ffddde7e595b2e711711a13b698d672593062a983c8f907ac33d27b6e197d5b237e93d7cc50adf512910a20c8a519d2c4f3a373790fa2e997b

Score
10/10

Malware Config

Extracted

Family

asyncrat

C2

:

Mutex

Attributes
  • aes_key

    +�aӯ�'ʞ�/x���$�0M�U��=tG��n^R4�]'�[��%ii$��J��?8��X�[4�"x�

  • anti_detection

  • autorun

  • bdos

    ����� ��hӕa��giV���J��� ���"�e��,�e��Q��T� tXC��VK�p� ����f�[!����KI:[MЪ��f�^�^���̊.��H�D�U�Ƅ� h�v&;Ja#����&�񱔊���r��﹃^Ú銽0���4K��& �ɂ��.���#A���ۂ׌Db�?פ��ۄB�.���+��}mS���Sf�av�l��.�V�Z�I4����J��{sz�v6��کm9��Oq���|�`Q1��x�Z֦��͉����>:G[�����w���A���m ����p�.̾�Y�Z"D���+B9/��*ލ wL\�ӲA .�d��!���q '��3�L�T���t�{�~���w��� p}\5Lp��]�m_i=�y��W~���u��T�C�ϛ�=i��i�Ĕ��E�qN��(��+=My��e E�d�K  x&������r��)

  • delay

  • host

  • hwid

    RfjEVZG2lLGzXvoLb3FEm0BesrAsnQZyoZ7JTTs9icijIYmBeXz1ys3ggiKJioYH1eYlB65ani3T1ZKKHHR7bQ==

  • install_file

  • install_folder

    whcbAN1YqHhzYjCksBvnmad2jCCevmztUqRnQFMgm9XkYdLVo9uf6FSevbq6gKewBkzZq+KMYlmMcKPQlxhzCA==

  • mutex

  • pastebin_config

    ���˰Ir�������1QF P<�U�Ch��%+x.��/B���y�l�R��܁>+-�9����y˄4q��b..��$S����a..6��>e�G�o�͏ �4�r���MD���n�f��J���M/�l��4���%s i�N)�?��9��.�'L͍<`�Ht�9�J����� 1�ɥ�A�K$`m��OM ���Hf5^���qO��)�)s�`�9���eH~Y� ���H�������> ��jw��G��8���u���������L= ��]��p�R���B� hU�s5U��.כh�K�0&*G��з�j�VE2�}�?%��; ����DzX��bh���� r�P%p�O�2��(cWZLC#���I�ޢ\�hP��V|���EH Z�4"��]63P�m3���'� ���L�M#������\������)�������<=���K���t����#0]U>��@g|`�!V0q�D�B�C�cu����o�,V�W �6��9���Q����L��|ޅt�! �U��j�f�N>\.��8�{�O����e��,��W��@�[7��[��"���*%#�������i�C3��d��Q)�� ��6M9 �޵}gBr�+r���Q����8��bdAl�I�#���:0���0uP���5��I!$��C���\J���4&4����Y+6� m�H/}�y�aIZ��|��z�Nf���MP�=�� � xB�!վ Hwg�(=P�$^?�#�`7�ɱ.���:RB��<5�m��/ʪGx��s��u��UsD4Dp��?M}8L�by�Ɇ�d��Y("�'Uu)P)mY�N}벡P�&)1�G���f��ʓ�(���-�'����:4����7�H�E��A3��B����N1��h�/t��EZ�c �>� ���L� �m� ���bQ���a��t�S�5[.:��σ�/�pKP��� �HQ,N�n�]��ւx0>%k��Z���+�*��M�+� ����O� �_$���� �rOv'�h�[� C��`�Ŀ��(�?��h�S=���/V��_���s1���;�ۙ2��$zw�_�����ϟ$��Ƀ�Q X��+T�t�p̎4�I�X4z$4�p��Ўr���E97l�y;�5����!a�MF6���]��\���� ]��, C>��=������y����;����n�|]뇿Y��1ݴ� �/I��>��Ӑ� �5����qq$ُ �<�e���O��!�:.5�de���:�j��&���GB��EAc��d6ꖭ��ɍݜ8~��0�®bD-*�v�x��4 7K��J����dQe� �r�\ �G���������U��H�E �ѬC�E��:�����oM��óa����2Ɔ|���@���K�G��=,F�"���(�i���Ω8�I�����y��EN2�e��n�݉� ������R����^�����|��^�����9m��� �[�!�Fr�G����b�:��C8^oܫ��uR�;’�

  • port

  • version

aes.plain

Targets

    • Target

      c944a6bcaab3b4af2af84c1751db99269832885bc87222532fdfea93526bf787

    • Size

      99KB

    • MD5

      e92f13a1fc90512b19a32c01a5bfe477

    • SHA1

      4cb8bf72e71a20d1a1b7ecc0b7f5d7b8f17f2965

    • SHA256

      c944a6bcaab3b4af2af84c1751db99269832885bc87222532fdfea93526bf787

    • SHA512

      4c271aa8545ad3bcccdcc663076f402521441fab9818fec9675ab0d5e87d2022ced535a10f89da6efe4366f7b9a82ec2929de965dbe490aeca6f36b8921aeac0

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Async RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Command and Control

Web Service

1
T1102

Tasks