Overview

overview

10

Static

static

1798_.jpg.ps1

windows7_x64

10

1798_.jpg.ps1

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1798_.jpg.ps1

  • Size

    262KB

  • Sample

    211225-nepsesgfep

  • MD5

    3bb7a462c0fbde3ad0466454a3b31597

  • SHA1

    c182f5bd9c742997e336468664193edbb13f69e5

  • SHA256

    e3bb74650d18fcefe9eb26f27fc72f2d68798d7f818ae40b861d9202054a544a

  • SHA512

    e919dddb57d989e8fcffa79233bbc9cdfe8d62b144d84750b554fc40e324476cde72161ae61fea0926765cdd67f215c2904818d905e5fcb224353f596c88624c

Score
10/10
asyncratzain-workrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

ZAIN-WORK

C2

2pop.ddns.net:6666

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      1798_.jpg.ps1

    • Size

      262KB

    • MD5

      3bb7a462c0fbde3ad0466454a3b31597

    • SHA1

      c182f5bd9c742997e336468664193edbb13f69e5

    • SHA256

      e3bb74650d18fcefe9eb26f27fc72f2d68798d7f818ae40b861d9202054a544a

    • SHA512

      e919dddb57d989e8fcffa79233bbc9cdfe8d62b144d84750b554fc40e324476cde72161ae61fea0926765cdd67f215c2904818d905e5fcb224353f596c88624c

    Score
    10/10
    asyncratzain-workrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks