Overview

overview

10

Static

static

11123d69e8...62.exe

windows7_x64

10

11123d69e8...62.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11123d69e824e0a71b1b6eb8204401bd9484630341b30875bb0f8a6cea3b3b62.zip

  • Size

    829KB

  • Sample

    220705-sge38aadbk

  • MD5

    18bc13e0dfe72622159d03ca5ef9b870

  • SHA1

    e2dd1139f7170e774c2d7645ae1b501403792cf3

  • SHA256

    89f3f1baf35a8dc5a98f9b7c6fe442c8c51f5cce76dee750484a7f944e8e3df3

  • SHA512

    77da70646dff56899ec4ac78e0fa4b1c676f9e7a5e09326bd4dea3ed76ec25c4efa76e18f4fede091c9f06d5bca6617821bbafe0509764a06a77435d622cd560

Score
10/10
asyncratdefaultevasionrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

polymoly.info:4199

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    siliconsoft.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      11123d69e824e0a71b1b6eb8204401bd9484630341b30875bb0f8a6cea3b3b62

    • Size

      876KB

    • MD5

      7ffee898b3e5bcb568717fc44dc81e8a

    • SHA1

      40bc0a93b02b32daff22716c400aedcae4ba9c15

    • SHA256

      11123d69e824e0a71b1b6eb8204401bd9484630341b30875bb0f8a6cea3b3b62

    • SHA512

      1327e940ae65514964f5973659ade4d8e906eda544e450dc8426c73d5a7c762bdf6f8523cd3440519a02d7a6e63f65dd7e128f0ba923560a3ed1ebb1a12d03bf

    Score
    10/10
    asyncratdefaultevasionrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks