Overview

overview

10

Static

static

108EAF1441...CE.exe

windows7_x64

10

108EAF1441...CE.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    108EAF14413F7CDD9F604E49493E9ACE.exe

  • Size

    835KB

  • Sample

    210619-q52g418lnx

  • MD5

    108eaf14413f7cdd9f604e49493e9ace

  • SHA1

    a284d52fee63659a2a6f3653a80755da207cfe97

  • SHA256

    ceddcfa72226e91f7435facafe6631d1385ca4d246d242d5136ac4e9462b8611

  • SHA512

    90d99f1ec38f215d8202fe5a1f655916b6052d986782df97fa212241003d36ecdaf5c43f5bb7838704c5fad87fc19639da569d0c45bdca564941606ed63a8e38

Score
10/10
asyncratpyinstallerratspywarestealer

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

alemdar571.duckdns.org:59

alemdar571.duckdns.org:18

alemdar571.duckdns.org:4784

alemdar571.duckdns.org:5900
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    lY8krPgIobK8M3LtrC7Eb7pALRZjw52Q

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    ZOOORT

  • host

    alemdar571.duckdns.org

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    59,18,4784,5900

  • version

    0.5.7B

aes.plain

Targets

    • Target

      108EAF14413F7CDD9F604E49493E9ACE.exe

    • Size

      835KB

    • MD5

      108eaf14413f7cdd9f604e49493e9ace

    • SHA1

      a284d52fee63659a2a6f3653a80755da207cfe97

    • SHA256

      ceddcfa72226e91f7435facafe6631d1385ca4d246d242d5136ac4e9462b8611

    • SHA512

      90d99f1ec38f215d8202fe5a1f655916b6052d986782df97fa212241003d36ecdaf5c43f5bb7838704c5fad87fc19639da569d0c45bdca564941606ed63a8e38

    Score
    10/10
    asyncratpyinstallerratspywarestealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks