Description
AsyncRAT is designed to remotely monitor and control other computers.
Zakaz na pokupku 21-10-2021.doc
General
Target
Size
Sample
Zakaz na pokupku 21-10-2021.doc
4KB
211021-wkp95sbeap
Score
10 /10
MD5
SHA1
SHA256
SHA512
e205f10f887754bd65281f14c25c0f21
b356aab56ba5eb993326e4ede7e254e7181aa165
5d77fcbee204c6b9fea6ec4bda5216714e2e46f4247f673956e64e36a9c3424d
cd43d1cb4193ef5aa4f77a290e186a4e87d55f42a61b502cbc2beeb2044613855e82553effca9f6bcda5cd4174c8c0ce6989774530c3b68c7a612ba26c2ef0a2
Malware Config
Extracted
| Family | asyncrat |
| Version | 0.5.7B |
| Botnet | 1 |
| C2 |
185.157.160.136:1973 |
| Attributes |
anti_vm false
bsod false
delay 38
install false
install_folder %AppData%
pastebin_config null |
| aes.plain |
|
Targets
Target
MD5
Filesize
Zakaz na pokupku 21-10-2021.doc
e205f10f887754bd65281f14c25c0f21
4KB
Score
10/10
SHA1
SHA256
SHA512
b356aab56ba5eb993326e4ede7e254e7181aa165
5d77fcbee204c6b9fea6ec4bda5216714e2e46f4247f673956e64e36a9c3424d
cd43d1cb4193ef5aa4f77a290e186a4e87d55f42a61b502cbc2beeb2044613855e82553effca9f6bcda5cd4174c8c0ce6989774530c3b68c7a612ba26c2ef0a2
Tags
Signatures
-
AsyncRat
-
BitRAT
Description
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
Tags
-
BitRAT Payload
-
Async RAT payload
Tags
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
Tags
TTPs
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks