Overview

overview

10

Static

static

Transferen...ar.jar

windows7_x64

10

Transferen...ar.jar

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Transferencias Copiar.jar

  • Size

    287KB

  • Sample

    220701-lvgqmseab7

  • MD5

    513cc3544b4a0523218326b30e99b46b

  • SHA1

    0927ad5ab4a30014fe0125793729ca9f8a74d95a

  • SHA256

    d021841d4a25bbe872ac7f71427e5731e441a9f6150f6ebb208c664d6ba48acd

  • SHA512

    fe435151e2d374858426777b95c18fb5590ab745815a43e58ad6ae4d6c19610895750d6cebcfc7341cedf6b3ed78c46db06b8d2b74ba889618a54222326a7ecf

Score
10/10
asyncratstrratdefaultpersistenceratstealertrojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

franmhort.duia.ro:8153

Mutex

Mutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    win.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Transferencias Copiar.jar

    • Size

      287KB

    • MD5

      513cc3544b4a0523218326b30e99b46b

    • SHA1

      0927ad5ab4a30014fe0125793729ca9f8a74d95a

    • SHA256

      d021841d4a25bbe872ac7f71427e5731e441a9f6150f6ebb208c664d6ba48acd

    • SHA512

      fe435151e2d374858426777b95c18fb5590ab745815a43e58ad6ae4d6c19610895750d6cebcfc7341cedf6b3ed78c46db06b8d2b74ba889618a54222326a7ecf

    Score
    10/10
    asyncratstrratdefaultpersistenceratstealertrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks