Overview

overview

10

Static

static

53F956128D...B3.exe

windows7_x64

10

53F956128D...B3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53F956128D25A910F9B7BD8461C547B3.exe

  • Size

    580KB

  • Sample

    210802-zh9sxnelh6

  • MD5

    53f956128d25a910f9b7bd8461c547b3

  • SHA1

    ccffaa842d73e179bd7cef67a4365a938c801b2a

  • SHA256

    ce9ab261ed9af4a7e758e80ab1134f43a97cc7d4a3579ecd64bc03b873511010

  • SHA512

    7fe6392539ce3d252a71073631963b6b28f85e792477327bf38c5c91ea8371e4d4d55e189e94f8095c0c281e4fc1d61bc20ea60770caf3f2c4b125f987639ebf

Score
10/10
asyncratevasionpyinstallerratspywarestealersuricatatrojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

jeazerx.duckdns.org:6606

jeazerx.duckdns.org:7707

jeazerx.duckdns.org:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    PgTuKivaePpq0opJl6Yxd3r0ifHfxcqG

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    CRAFTRISE7

  • host

    jeazerx.duckdns.org

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    6606,7707,8808

  • version

    0.5.7B

aes.plain

Targets

    • Target

      53F956128D25A910F9B7BD8461C547B3.exe

    • Size

      580KB

    • MD5

      53f956128d25a910f9b7bd8461c547b3

    • SHA1

      ccffaa842d73e179bd7cef67a4365a938c801b2a

    • SHA256

      ce9ab261ed9af4a7e758e80ab1134f43a97cc7d4a3579ecd64bc03b873511010

    • SHA512

      7fe6392539ce3d252a71073631963b6b28f85e792477327bf38c5c91ea8371e4d4d55e189e94f8095c0c281e4fc1d61bc20ea60770caf3f2c4b125f987639ebf

    Score
    10/10
    asyncratevasionpyinstallerratspywarestealersuricatatrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Modifies security service

      evasion

    • suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

      suricata

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks