Overview

overview

10

Static

static

Inquiry_TR...at.exe

windows7_x64

10

Inquiry_TR...at.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Inquiry_TRASKO Ltd.bat.exe

  • Size

    675KB

  • Sample

    220126-rmav1sebb2

  • MD5

    fac3b8f2d85a7876ffa623a67ca3f6ae

  • SHA1

    6583251903d4c33ce658bff984db0e24e2db0b2a

  • SHA256

    b17340a23a7971818b456182495976b46413f10b7570b3dd78cd189cff3b22f8

  • SHA512

    0a29f75e2c843e033aa0110678d5f56d5c3d50bd74e022660c8893f0bd59303defe48233a5425a357c33f53405f6bd7b3947284f3d4cd84623557c6974d61bc9

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

fforward20.duckdns.org:6606

fforward20.duckdns.org:7707

fforward20.duckdns.org:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      Inquiry_TRASKO Ltd.bat.exe

    • Size

      675KB

    • MD5

      fac3b8f2d85a7876ffa623a67ca3f6ae

    • SHA1

      6583251903d4c33ce658bff984db0e24e2db0b2a

    • SHA256

      b17340a23a7971818b456182495976b46413f10b7570b3dd78cd189cff3b22f8

    • SHA512

      0a29f75e2c843e033aa0110678d5f56d5c3d50bd74e022660c8893f0bd59303defe48233a5425a357c33f53405f6bd7b3947284f3d4cd84623557c6974d61bc9

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks