Overview

overview

10

Static

static

Erodo.exe

windows7_x64

10

Erodo.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Erodo.exe

  • Size

    342KB

  • Sample

    220404-dxs8fsheg9

  • MD5

    0d0d64eecf0771dfc73ea6674802c256

  • SHA1

    a9eb93937399030d52ce1641794b0fab1c398724

  • SHA256

    f927fc3dee7de6daefed3b155907078344fbfec8bd3d63ed96013c2c9ae1e78e

  • SHA512

    d424f4ad1298e483d7707d8e8feb5a9bd836830923b487c574b0d1e8cccf3840182e35765220c464e3310caed7c409594af1c2a604302f90d631664ff0765cd1

Score
10/10
asyncrat2persistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

2

C2

212.193.30.54:9524

Mutex

wyQ92!.,=FT72few

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Erodo.exe

    • Size

      342KB

    • MD5

      0d0d64eecf0771dfc73ea6674802c256

    • SHA1

      a9eb93937399030d52ce1641794b0fab1c398724

    • SHA256

      f927fc3dee7de6daefed3b155907078344fbfec8bd3d63ed96013c2c9ae1e78e

    • SHA512

      d424f4ad1298e483d7707d8e8feb5a9bd836830923b487c574b0d1e8cccf3840182e35765220c464e3310caed7c409594af1c2a604302f90d631664ff0765cd1

    Score
    10/10
    asyncrat2persistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks