Overview

overview

10

Static

static

AWB#530532...df.exe

windows7_x64

10

AWB#530532...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1bf55c75f582331db0b200e69ea81ec708abdc47ebcd1e7308fcff046dec46fd

  • Size

    294KB

  • Sample

    220521-dxxwmsgeb9

  • MD5

    e7895470727996f92992b778835ed427

  • SHA1

    5a7bd87ad0b80971322cf24d11b7a5e11d4c4651

  • SHA256

    1bf55c75f582331db0b200e69ea81ec708abdc47ebcd1e7308fcff046dec46fd

  • SHA512

    c21d4c867883a771e61c7d316b7f4d5a79d2b861099c88e6f5b095b3d3246814165b8812c33b170aa64601bb3a0e6ac1f3bd5c408d195d46652d997d71fd8374

Score
10/10
asyncratmay11thupcoreentityratrezer0

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

MAY11thUP

Mutex

chizzy25@!7^UP

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/HKYwiN9V

aes.plain

Targets

    • Target

      AWB#5305323204641,pdf.exe

    • Size

      233KB

    • MD5

      88e05a7f3b27e3aed5d577949c867917

    • SHA1

      180a4cabbb5ea319ff1210f5686c7779d0dd58c7

    • SHA256

      f3b33a885af940210f10df7e1c96dc388161961dcb52b6d84c3b7458d20ce116

    • SHA512

      3d42bc7888584efea5d8a0a48b6293c54405d0186f3d8a45741f4e371ee143a5d1411be8f69dbe5aa5957b8dbad921100872206408a431849de4c826db875bbe

    Score
    10/10
    asyncratmay11thupcoreentityratrezer0

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • Async RAT payload

      rat

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks