8febef9e39284335678e45955722d6a6

General
Target

8febef9e39284335678e45955722d6a6

Size

617KB

Sample

211021-xbrmaabefr

Score
10 /10
MD5

8febef9e39284335678e45955722d6a6

SHA1

0f5de2557c7cef0c486157089cf2b761ca8839d7

SHA256

7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf

SHA512

e8b70e73b960b4fa3fa209baaf702990dc4a153cca85eca5a9586ab42dab82d99d6ecec15c9ed043cca2637710f2921f94b2a2b934c9960fe36514cdf4ceacbf

Malware Config

Extracted

Family asyncrat
Version 0.5.7B
Botnet 1
C2

185.157.160.136:1973

Attributes
anti_vm
false
bsod
false
delay
38
install
false
install_folder
%AppData%
pastebin_config
null
aes.plain
Targets
Target

8febef9e39284335678e45955722d6a6

MD5

8febef9e39284335678e45955722d6a6

Filesize

617KB

Score
10 /10
SHA1

0f5de2557c7cef0c486157089cf2b761ca8839d7

SHA256

7fcb98579512e3df028c8199b530d8e027d55a871d2afb81aeb5994adac814bf

SHA512

e8b70e73b960b4fa3fa209baaf702990dc4a153cca85eca5a9586ab42dab82d99d6ecec15c9ed043cca2637710f2921f94b2a2b934c9960fe36514cdf4ceacbf

Tags

Signatures

  • AsyncRat

    Description

    AsyncRAT is designed to remotely monitor and control other computers.

    Tags

  • BitRAT

    Description

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    Tags

  • BitRAT Payload

  • Async RAT payload

    Tags

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Tasks

                      static1

                      behavioral2

                      10/10