Overview

overview

10

Static

static

10

UD_PO_000681.exe

windows7_x64

10

UD_PO_000681.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f7e5dbb3a9a8eaf64415ff8ec0ae985fb8b9d3882693231dc016f263d83f4c0

  • Size

    544KB

  • Sample

    220521-pjmdjaafbp

  • MD5

    3754efa33a1c67dea4497a2da1f6ca4a

  • SHA1

    6a2aeb29f952eedc58428990983072266f3e860f

  • SHA256

    7f7e5dbb3a9a8eaf64415ff8ec0ae985fb8b9d3882693231dc016f263d83f4c0

  • SHA512

    b00c1bda2a2c613de403bbef4ee178482fa827d290ab4cdcd1bc50adf3be1654beaa6a448d410ea22f15e5d49bcfaea67a299845d5b0426d6d045ce4822172d6

Score
10/10
asyncratcbccpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

cbcc

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    billionaire.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/8wApsDtD

aes.plain

Targets

    • Target

      UD_PO_000681.exe

    • Size

      483KB

    • MD5

      24a8d8c071bbb496ba8e64e7817fd6c9

    • SHA1

      f40194270a9475aeb044a062bd7ef9376d8ed857

    • SHA256

      c890bc2e899bdb9c2a7cbe9ab52b852c5ea6832e44615f2afc66ab47925866d2

    • SHA512

      c4dcbb0b0fdc7469c6e5abc038867f3c65e179a3692dc884d7713db20c2fdefb4f96d5369210aedf807008cbe3821b05fb2a162c45a603aa0c68d56962d4e9a0

    Score
    10/10
    asyncratcbccpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks