Overview

overview

10

Static

static

9f18eca7a1...ce.exe

windows7_x64

10

9f18eca7a1...ce.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f18eca7a171f9632ac463d09d6e8dce

  • Size

    333KB

  • Sample

    220304-jw5gzsffbn

  • MD5

    9f18eca7a171f9632ac463d09d6e8dce

  • SHA1

    cc1412530b20bf95663c4efc49eb08387e689be6

  • SHA256

    d897279f21d4e5e36d89eb1eba9dcf995855a076d1578c644ff1726fc11d3d8b

  • SHA512

    d23e0d42469a38f20f570fab18f7bbe0dd874b8ad6f20fa65876f34ba28e02f0f52e26051b788536b44c0dc7b1cb1b166139d1df5fc9518fab2341a6ba6bb9ec

Score
10/10
asyncrat2persistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

2

C2

212.193.30.54:9524

Mutex

wyQ92!.,=FT72few

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      9f18eca7a171f9632ac463d09d6e8dce

    • Size

      333KB

    • MD5

      9f18eca7a171f9632ac463d09d6e8dce

    • SHA1

      cc1412530b20bf95663c4efc49eb08387e689be6

    • SHA256

      d897279f21d4e5e36d89eb1eba9dcf995855a076d1578c644ff1726fc11d3d8b

    • SHA512

      d23e0d42469a38f20f570fab18f7bbe0dd874b8ad6f20fa65876f34ba28e02f0f52e26051b788536b44c0dc7b1cb1b166139d1df5fc9518fab2341a6ba6bb9ec

    Score
    10/10
    asyncrat2persistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks