Overview

overview

10

Static

static

Copyexport...s7.exe

windows7_x64

10

Copyexport...s7.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CopyexportdocumentsMay03052021ScaannedCopies7.exe

  • Size

    182KB

  • Sample

    210503-nlyee9rbm2

  • MD5

    561e66ab89bb2e930bb743130d676115

  • SHA1

    dd19eebda3867a174b104ee2d26e0c6a40337253

  • SHA256

    a3af875c94ed804c15cb508884edad66cc1d7784fbf2f42cfd450deac4e52577

  • SHA512

    7962f76415e50389821cb3196e000a5b562d0541ac2eba078e10a3429fdb8452363daebda42e6549ba780b0017ca5ee5a9e0fc256ef8407689ef08afdff7eebb

Score
10/10
asyncratrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

C2

asyynet.duckdns.org:5687

Mutex

ffcvfwedwsswederf4fredwseewwjjdjdhshhshd

Attributes
  • aes_key

    KHHi77aXZ19TMUsXIRXk76wbzryWK58m

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    TURK

  • host

    asyynet.duckdns.org

  • hwid

    1

  • install_file

  • install_folder

    %AppData%

  • mutex

    ffcvfwedwsswederf4fredwseewwjjdjdhshhshd

  • pastebin_config

    null

  • port

    5687

  • version

    0.5.7A

aes.plain

Targets

    • Target

      CopyexportdocumentsMay03052021ScaannedCopies7.exe

    • Size

      182KB

    • MD5

      561e66ab89bb2e930bb743130d676115

    • SHA1

      dd19eebda3867a174b104ee2d26e0c6a40337253

    • SHA256

      a3af875c94ed804c15cb508884edad66cc1d7784fbf2f42cfd450deac4e52577

    • SHA512

      7962f76415e50389821cb3196e000a5b562d0541ac2eba078e10a3429fdb8452363daebda42e6549ba780b0017ca5ee5a9e0fc256ef8407689ef08afdff7eebb

    Score
    10/10
    asyncratrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks