cc1b6971441d2ec84c14247d4f014912

General
Target

cc1b6971441d2ec84c14247d4f014912

Size

32KB

Sample

220218-nyfzmadchn

Score
10 /10
MD5

cc1b6971441d2ec84c14247d4f014912

SHA1

a786dcb3bffe527a6954d3c242138d34707e21d3

SHA256

af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8

SHA512

a91cf7ebd024a5431ee8e2202740809fb6dace5d4965be107b6f83bbed34f21bde21d45a79e08401791cd204db8d9c23b00d791f8bc5714a6e33022f8aada77b

Malware Config

Extracted

Family asyncrat
Version 0.5.7B
Botnet 1
C2

212.193.30.54:8755

Attributes
anti_vm
false
bsod
false
delay
3
install
false
install_folder
%AppData%
pastebin_config
null
aes.plain
Targets
Target

cc1b6971441d2ec84c14247d4f014912

MD5

cc1b6971441d2ec84c14247d4f014912

Filesize

32KB

Score
10/10
SHA1

a786dcb3bffe527a6954d3c242138d34707e21d3

SHA256

af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8

SHA512

a91cf7ebd024a5431ee8e2202740809fb6dace5d4965be107b6f83bbed34f21bde21d45a79e08401791cd204db8d9c23b00d791f8bc5714a6e33022f8aada77b

Tags

Signatures

  • AsyncRat

    Description

    AsyncRAT is designed to remotely monitor and control other computers.

    Tags

  • Async RAT payload

    Tags

  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Tasks

                    static1

                    behavioral1

                    10/10

                    behavioral2

                    10/10