Overview

overview

10

Static

static

PI-23456776544567.exe

windows7_x64

10

PI-23456776544567.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PI-23456776544567.exe

  • Size

    127KB

  • Sample

    211022-jr5bescbfr

  • MD5

    6b81a0180a2d391af6b604b016b90d01

  • SHA1

    180493fe32b38958cf63926b2f568555aa44f5f7

  • SHA256

    278602396c9f613328746aa33d0fa09d0aac466c68ca349ec0d8193d664aef35

  • SHA512

    b8f4e9326da11c7ba12d3e72f31f4602f47097668a57bcd5b36296b30b8b4aa4e036d3dd3911f8601806e53bb4424b3a49ef3421b4bea3f45888cc7a75646b09

Score
10/10
asyncratpi-23456787654456evasionratsuricatatrojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

PI-23456787654456

C2

91.193.75.132:8808

91.193.75.132:9909

91.193.75.132:7779
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    true

  • install_file

    AppData.exe

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      PI-23456776544567.exe

    • Size

      127KB

    • MD5

      6b81a0180a2d391af6b604b016b90d01

    • SHA1

      180493fe32b38958cf63926b2f568555aa44f5f7

    • SHA256

      278602396c9f613328746aa33d0fa09d0aac466c68ca349ec0d8193d664aef35

    • SHA512

      b8f4e9326da11c7ba12d3e72f31f4602f47097668a57bcd5b36296b30b8b4aa4e036d3dd3911f8601806e53bb4424b3a49ef3421b4bea3f45888cc7a75646b09

    Score
    10/10
    asyncratpi-23456787654456evasionratsuricatatrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Turns off Windows Defender SpyNet reporting

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

      suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

      suricata

    • Async RAT payload

      rat

    • Nirsoft

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

5
T1089

Bypass User Account Control

1
T1088

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks