Description
AsyncRAT is designed to remotely monitor and control other computers.
cc1b6971441d2ec84c14247d4f014912
General
Target
Size
Sample
cc1b6971441d2ec84c14247d4f014912
32KB
220218-nyfzmadchn
Score
10 /10
MD5
SHA1
SHA256
SHA512
cc1b6971441d2ec84c14247d4f014912
a786dcb3bffe527a6954d3c242138d34707e21d3
af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8
a91cf7ebd024a5431ee8e2202740809fb6dace5d4965be107b6f83bbed34f21bde21d45a79e08401791cd204db8d9c23b00d791f8bc5714a6e33022f8aada77b
Malware Config
Extracted
| Family | asyncrat |
| Version | 0.5.7B |
| Botnet | 1 |
| C2 |
212.193.30.54:8755 |
| Attributes |
anti_vm false
bsod false
delay 3
install false
install_folder %AppData%
pastebin_config null |
| aes.plain |
|
Targets
Target
MD5
Filesize
cc1b6971441d2ec84c14247d4f014912
cc1b6971441d2ec84c14247d4f014912
32KB
Score
10/10
SHA1
SHA256
SHA512
a786dcb3bffe527a6954d3c242138d34707e21d3
af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8
a91cf7ebd024a5431ee8e2202740809fb6dace5d4965be107b6f83bbed34f21bde21d45a79e08401791cd204db8d9c23b00d791f8bc5714a6e33022f8aada77b
Tags
Signatures
-
AsyncRat
-
Async RAT payload
Tags
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Adds Run key to start application
Tags
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks