Overview

overview

10

Static

static

A33BE1069F...89.exe

windows7_x64

10

A33BE1069F...89.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe
  • Size 984KB
  • Sample210712-5d7tthrfpa
  • SHA256 a33be1069f51683e3ef5290bedad88f032df7b67fde8955bf2ad72b2f8d5e647
  • MD5 SHA1 SHA512
Score
10/10
asyncratquasarbitt21discoveryratspywaretrojan

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.7B

C2

  • pettbull.ddns.net:6606

  • pettbull.ddns.net:7707

  • pettbull.ddns.net:8808

Mutex

  • AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    Rf0cBtTiTPesPoSUe1juZE7Kx9eHMndW

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    CHAP21

  • host

    pettbull.ddns.net

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    6606,7707,8808

  • version

    0.5.7B

aes.plain

Extracted

Family

  • quasar

Version

  • 1.4.0

Botnet

  • BITT21

C2

  • pettbull.ddns.net:4782

Mutex

  • 42a7796c-8301-4ac9-9f03-c5e40867d833

Attributes
  • encryption_key

    DAE9E02E5E04D59D9AF2AA1D5E82248D5919AC6A

  • install_name

    Windows Service.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Microsoft Windows

  • subdirectory

    Windows Update

Targets

    • Target
      A33BE1069F51683E3EF5290BEDAD88F032DF7B67FDE89.exe
    • Size 984KB
    • SHA256 a33be1069f51683e3ef5290bedad88f032df7b67fde8955bf2ad72b2f8d5e647
    • MD5 SHA1 SHA512
    Score
    10/10
    asyncratquasarbitt21discoveryratspywaretrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Quasar Payload

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks