Overview

overview

10

Static

static

LKGFCV.vbs.vbs

windows7_x64

8

LKGFCV.vbs.vbs

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LKGFCV.vbs.vbs

  • Size

    730B

  • Sample

    210727-zgjha4yhj6

  • MD5

    8a7246cc77596aa840c15b3ac9907c4e

  • SHA1

    c34f30b5aa3777cf3b3d35cfd8af330f8af97981

  • SHA256

    c7be7d6e94c31e0f376d1cb9be3e0f311d57ae1a318437dc7c28b2574a73be31

  • SHA512

    790e62a08b098dcdda4dfc1cc218712f069426b639420aca7ae6dfbd239f765fe379b92847d12da8a8f68699068d1779e7415d1c76fa64a989ae9dfa8b7dbe94

Score
10/10
asyncratratsuricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

newfrost.ddns.net:6666

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    iQqiAD9kmzPLel2oEjZjj8tYKfnH5XkL

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    new

  • host

    newfrost.ddns.net

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    6666

  • version

    0.5.7B

aes.plain

Targets

    • Target

      LKGFCV.vbs.vbs

    • Size

      730B

    • MD5

      8a7246cc77596aa840c15b3ac9907c4e

    • SHA1

      c34f30b5aa3777cf3b3d35cfd8af330f8af97981

    • SHA256

      c7be7d6e94c31e0f376d1cb9be3e0f311d57ae1a318437dc7c28b2574a73be31

    • SHA512

      790e62a08b098dcdda4dfc1cc218712f069426b639420aca7ae6dfbd239f765fe379b92847d12da8a8f68699068d1779e7415d1c76fa64a989ae9dfa8b7dbe94

    Score
    10/10
    asyncratratsuricata

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

      suricata

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks