Overview

overview

10

Static

static

Request Fo...22.exe

windows7_x64

10

Request Fo...22.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Request For Quotation Invoice 26-01-2022.exe

  • Size

    679KB

  • Sample

    220126-lpcjqsbgg2

  • MD5

    c2bb2d4f92997abc98184627f82d1c17

  • SHA1

    615826b8e777a816aa66953be2ee781a04f993a8

  • SHA256

    a3831a809f241debe49dfbf4674fe0f2ee6ca776db06f87ff9a521a87774ddf0

  • SHA512

    0f71b3473d9a551393361695323433bea76f080ccc4dbf94218a2f1ed0e905a1e1ceb413a91412ecb09ba870f057fb20bfeeb1df6f3b384a7fa9c6646b7d276d

Score
10/10
asyncratdefaultratspywarestealer

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

89.238.150.43:57095

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    true

  • install_file

    chromeex.exe

  • install_folder

    %Temp%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      Request For Quotation Invoice 26-01-2022.exe

    • Size

      679KB

    • MD5

      c2bb2d4f92997abc98184627f82d1c17

    • SHA1

      615826b8e777a816aa66953be2ee781a04f993a8

    • SHA256

      a3831a809f241debe49dfbf4674fe0f2ee6ca776db06f87ff9a521a87774ddf0

    • SHA512

      0f71b3473d9a551393361695323433bea76f080ccc4dbf94218a2f1ed0e905a1e1ceb413a91412ecb09ba870f057fb20bfeeb1df6f3b384a7fa9c6646b7d276d

    Score
    10/10
    asyncratdefaultratspywarestealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks