Overview

overview

10

Static

static

4

8a2abab20b...9d.exe

windows7_x64

10

8a2abab20b...9d.exe

windows10_x64

10

Resubmissions

21-01-2025 11:37

250121-nrfehs1pby 10

12-07-2021 19:05

210712-p4pm4lvw8x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8a2abab20bf75ac19eaa73be3b09219d.exe

  • Size

    455KB

  • Sample

    210712-p4pm4lvw8x

  • MD5

    8a2abab20bf75ac19eaa73be3b09219d

  • SHA1

    c0fa652bb151644bf76b55f3c9d68cb5e8d7faf3

  • SHA256

    866ac65940057d6e1a125eda23a12d6743d75e6ff3a74ff6d53debb3fe90a368

  • SHA512

    e8842b9f47a5dce906ddca3dfbb608eba660c80364ed0b02b48c33e161df3e95226d713177733e7591cc7eccecb3f48e1a731576a90d6fbda194de98de5495c9

Score
10/10
asyncratlinkpdfpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

sbmsbm20.duckdns.org:2020

sbmsbm20.duckdns.org:3040

sbmsbm20.duckdns.org:4040

hpdndbnb.duckdns.org:2020

hpdndbnb.duckdns.org:3040

hpdndbnb.duckdns.org:4040
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    Lvyod3VuSZyfscnKiu0YIwvTV1TQp7CD

  • anti_detection

    false

  • autorun

    true

  • bdos

    false

  • delay

    Default

  • host

    sbmsbm20.duckdns.org,hpdndbnb.duckdns.org

  • hwid

    3

  • install_file

  • install_folder

    %Temp%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    2020,3040,4040

  • version

    0.5.7B

aes.plain

Targets

    • Target

      8a2abab20bf75ac19eaa73be3b09219d.exe

    • Size

      455KB

    • MD5

      8a2abab20bf75ac19eaa73be3b09219d

    • SHA1

      c0fa652bb151644bf76b55f3c9d68cb5e8d7faf3

    • SHA256

      866ac65940057d6e1a125eda23a12d6743d75e6ff3a74ff6d53debb3fe90a368

    • SHA512

      e8842b9f47a5dce906ddca3dfbb608eba660c80364ed0b02b48c33e161df3e95226d713177733e7591cc7eccecb3f48e1a731576a90d6fbda194de98de5495c9

    Score
    10/10
    asyncratlinkpdfpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Modifies WinLogon for persistence

      persistence

    • Async RAT payload

      rat

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks