Overview

overview

10

Static

static

Attachments.exe

windows7_x64

10

Attachments.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Attachments.iso

  • Size

    78KB

  • Sample

    220126-zvgmjaaga4

  • MD5

    d4598af3a8d1d7e310d95d5f3c674adb

  • SHA1

    050e4027dd8d801388d4542701cb25333e8ea40b

  • SHA256

    d4767a9247ca5ae1bbc2c00f4678f58e7bd6f8a7152fd51effd15168a878a2c5

  • SHA512

    1553a57b3e1fe36412127a8ec0bd76a4e070df5c198ab44541810a1bef52c5f515e5d7b5e0a4ea1bfae48e50ca540e326bb7acc0a84f2dce30e4b7a3819ae271

Score
10/10
asyncratpersistencerat

Malware Config

Targets

    • Target

      Attachments.exe

    • Size

      18KB

    • MD5

      634a457966e4aebe14c44c204a4fed86

    • SHA1

      f62dfe7c3a0db8ab50d4c858020a57503b479944

    • SHA256

      39f7b43c182fb69287831fd54fc6cc7733a22430f876416cb3a5a60c1da1faa1

    • SHA512

      c0da6e668e74877aab80e6acda09b683aed9145303aa6191cf52589de16d4961f9016f79acd39f932e60e06c700bbb9d5b3943f223c8316eb1a98cb6a4853ecb

    Score
    10/10
    asyncratpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks