Overview

overview

10

Static

static

d7490b3cd8...f4.exe

windows7_x64

10

d7490b3cd8...f4.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d7490b3cd8d992172d83744289079ff4.exe

  • Size

    1.0MB

  • Sample

    220129-k57t5shack

  • MD5

    d7490b3cd8d992172d83744289079ff4

  • SHA1

    8b14577b75be2e2546e090287167b0017a2ac000

  • SHA256

    cbde068b97a9081568dea732d561f26c52946ebbadf260c2305b46f369b20c9d

  • SHA512

    3ac675b5a7cc377b859d9619785fa9e5f834246b4ae1c77e5f3ac95bc8907b6480181da5d58753fa844e78b6391ba64ff51285ebb9f601fc2b18d410a8bfb7bd

Score
10/10
asyncratdefaultmicrosoftphishingratspywarestealersuricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

20.98.96.97:1605

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      d7490b3cd8d992172d83744289079ff4.exe

    • Size

      1.0MB

    • MD5

      d7490b3cd8d992172d83744289079ff4

    • SHA1

      8b14577b75be2e2546e090287167b0017a2ac000

    • SHA256

      cbde068b97a9081568dea732d561f26c52946ebbadf260c2305b46f369b20c9d

    • SHA512

      3ac675b5a7cc377b859d9619785fa9e5f834246b4ae1c77e5f3ac95bc8907b6480181da5d58753fa844e78b6391ba64ff51285ebb9f601fc2b18d410a8bfb7bd

    Score
    10/10
    asyncratdefaultratspywarestealersuricatamicrosoftphishing

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

      suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

      suricata

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks