Overview

overview

10

Static

static

update_py-...ge.exe

windows7_x64

5

update_py-...ge.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    update_py-final-stage.exe

  • Size

    486KB

  • Sample

    220121-rhvdvshhhm

  • MD5

    42aea50814ad0d8edce593ca559d142c

  • SHA1

    28af69152d3eac34d9dc8fec0a1ceb2c63de429a

  • SHA256

    9f4d88e9eeae7ffc241646d0233acb29bedbc9bc0c124b949567a894f8af6f54

  • SHA512

    7b8a19fd7de8c4ea639a448fa736d718fd8f10fc78ae73de6c260ea665410d50275791b1c30b219ae5ddfd3d66746eb1bdd15c55e41016707859db540e60d4c0

Score
10/10
asyncratcollectionevasionratsuricata

Malware Config

Extracted

Family

asyncrat

Version

v0.2

C2

niceone20.cn:7201

fjuj84hgoa84gn.xyz:7201

getupdated2021win2k.cn:7201
Mutex

afgj6j3umd5uk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    0

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      update_py-final-stage.exe

    • Size

      486KB

    • MD5

      42aea50814ad0d8edce593ca559d142c

    • SHA1

      28af69152d3eac34d9dc8fec0a1ceb2c63de429a

    • SHA256

      9f4d88e9eeae7ffc241646d0233acb29bedbc9bc0c124b949567a894f8af6f54

    • SHA512

      7b8a19fd7de8c4ea639a448fa736d718fd8f10fc78ae73de6c260ea665410d50275791b1c30b219ae5ddfd3d66746eb1bdd15c55e41016707859db540e60d4c0

    Score
    10/10
    asyncratcollectionevasionratsuricata

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

      suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

      suricata

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Modifies Windows Firewall

      evasion

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks