Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e077c490ee9e566446bd6c2b267c057c5bd0626769e042c8ee98f5249c74841c

  • Size

    432KB

  • Sample

    211202-tczshadch6

  • MD5

    2844578cbbd22c6efcb1a779a1bf75dc

  • SHA1

    37c626505358828d1a9d710a48e5f9b8c620ba2d

  • SHA256

    e077c490ee9e566446bd6c2b267c057c5bd0626769e042c8ee98f5249c74841c

  • SHA512

    254d378b36f59ccbb1a0e0d461a0f7dcfe2f5c8b1a883474d7b38da88ef757e1a219f175d169ab7dc7ebc4b547b20ad5722bc6fcc4575e105a315f90e20a6bc4

Score
10/10
asyncrat3persistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

3

C2

217.64.149.93:1973

Mutex

df4Rtg34dFt5ynrew

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      e077c490ee9e566446bd6c2b267c057c5bd0626769e042c8ee98f5249c74841c

    • Size

      432KB

    • MD5

      2844578cbbd22c6efcb1a779a1bf75dc

    • SHA1

      37c626505358828d1a9d710a48e5f9b8c620ba2d

    • SHA256

      e077c490ee9e566446bd6c2b267c057c5bd0626769e042c8ee98f5249c74841c

    • SHA512

      254d378b36f59ccbb1a0e0d461a0f7dcfe2f5c8b1a883474d7b38da88ef757e1a219f175d169ab7dc7ebc4b547b20ad5722bc6fcc4575e105a315f90e20a6bc4

    Score
    10/10
    asyncrat3persistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks