Overview

overview

10

Static

static

New_Order_...te.exe

windows7_x64

10

New_Order_...te.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New_Order_PO#96072380_MT_Quote.xz

  • Size

    5KB

  • Sample

    210914-az3m5aefa5

  • MD5

    f255b641de3775b9035255dbcde60ceb

  • SHA1

    3512c4ea3a528c9aa7f39d092fb6f06601050b7f

  • SHA256

    e650ff0f1059083e9d97f2f6682c6a523f3b7121f53759955863c90802ff0a5c

  • SHA512

    a6fe11b7cb7aba42958808a651b3cfd12a6e4022ccd817e7c157de980d3afac6799796cb7b196e86d714ab43e86143503740cac956a9af58c821de899896ea1d

Score
10/10
asyncratrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

C2

joseedward5001.ddns.net:1515

194.5.98.120:1515
Mutex

cfbtvyfbge

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    5

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      New_Order_PO#96072380_MT_Quote.exe

    • Size

      13KB

    • MD5

      1ef313f5642433857bfb3eb1903faf84

    • SHA1

      b3c5a85551caff85b646c8175ceb297a6eb61d32

    • SHA256

      4def53afd3cfa7cf644b61a877f18ceed798dc8f62268afb52827ee61280d3ac

    • SHA512

      97ca39b7fd37920f737d69c7e99bff78e40f74b0e7fc6c15355da79b070577ef3d9fddfcd571bdcee35ef442bb6f50e81b27f4069cb7e13e87b36d43339fc27f

    Score
    10/10
    asyncratrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks