Overview

overview

10

Static

static

10

KGk7fkL6.exe

windows7_x64

10

KGk7fkL6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KGk7fkL6.exe

  • Size

    45KB

  • Sample

    210501-zey4gvqaz6

  • MD5

    6c3eefa15c5dcf8046a280f434363488

  • SHA1

    ba5ddc35cf6c386e3353973669d02c9379077b08

  • SHA256

    9e06b7c674cac8288caedab6c882b20dc66aa7e83299c724801791d402e5818c

  • SHA512

    282172cc98f831b9719f63e4e723426f2145053f725a3940d06cd975fd45790199f4adb0c308678f2a63d7bf846f6c2efbbe62b7acf75466f1fc8851da89b92e

Score
10/10
asyncratratspywarestealer

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

Tktlert.kro.kr:5000

Mutex

dwadwad1aw98d1965gtf*h47eft65h14fte98h41rt6h1ft789h41rft9h

Attributes
  • aes_key

    kuTGboagNLBMaK5ftkoTGf5T7oZj2sRO

  • anti_detection

    true

  • autorun

    true

  • bdos

    true

  • delay

    Default

  • host

    Tktlert.kro.kr

  • hwid

    3

  • install_file

  • install_folder

    %Temp%

  • mutex

    dwadwad1aw98d1965gtf*h47eft65h14fte98h41rt6h1ft789h41rft9h

  • pastebin_config

    null

  • port

    5000

  • version

    0.5.7B

aes.plain

Targets

    • Target

      KGk7fkL6.exe

    • Size

      45KB

    • MD5

      6c3eefa15c5dcf8046a280f434363488

    • SHA1

      ba5ddc35cf6c386e3353973669d02c9379077b08

    • SHA256

      9e06b7c674cac8288caedab6c882b20dc66aa7e83299c724801791d402e5818c

    • SHA512

      282172cc98f831b9719f63e4e723426f2145053f725a3940d06cd975fd45790199f4adb0c308678f2a63d7bf846f6c2efbbe62b7acf75466f1fc8851da89b92e

    Score
    10/10
    asyncratratspywarestealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks