Overview

overview

10

Static

static

Q-B210426002.exe

windows7_x64

10

Q-B210426002.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Q-B210426002.exe

  • Size

    604KB

  • Sample

    210503-q3e44av39e

  • MD5

    d2dc47a6a92d45dba94e456ac4354dc0

  • SHA1

    63d871671fbf733cf56f746dded735e5e21f6f5b

  • SHA256

    046d650990c01b17f9e518a2c93fcad54247eb25ea194aa0939a8a9a7f31fe10

  • SHA512

    dc35d695f94ce4ca66da5208d4af204ef4744598f194b49e6346f724028c40b64b893e94f277166f780099cd5dde10270d20a5ead024b097a41cc06ea9a7a890

Score
10/10
asyncratrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

mazi.ddns.net:2066

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    QOvO5FC2sdXjluSQPHx2mlSamLh7qeQR

  • anti_detection

    false

  • autorun

    true

  • bdos

    false

  • delay

    Default

  • host

    mazi.ddns.net

  • hwid

    10

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    2066

  • version

    0.5.7B

aes.plain

Targets

    • Target

      Q-B210426002.exe

    • Size

      604KB

    • MD5

      d2dc47a6a92d45dba94e456ac4354dc0

    • SHA1

      63d871671fbf733cf56f746dded735e5e21f6f5b

    • SHA256

      046d650990c01b17f9e518a2c93fcad54247eb25ea194aa0939a8a9a7f31fe10

    • SHA512

      dc35d695f94ce4ca66da5208d4af204ef4744598f194b49e6346f724028c40b64b893e94f277166f780099cd5dde10270d20a5ead024b097a41cc06ea9a7a890

    Score
    10/10
    asyncratrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks