Overview

overview

10

Static

static

37b4e4f5b9...97.exe

windows7_x64

10

37b4e4f5b9...97.exe

windows10-2004_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37b4e4f5b9dde2fe83bba5b443d0cebb702aa14bf917749cdaaabb6ac7718997

  • Size

    745KB

  • Sample

    220708-h52l1shaa4

  • MD5

    c23c612d444df3953d1c8bcf0c4bb1fe

  • SHA1

    6315707b722a4edda1b3c7d167284a9cabe96c26

  • SHA256

    37b4e4f5b9dde2fe83bba5b443d0cebb702aa14bf917749cdaaabb6ac7718997

  • SHA512

    a72f51c1d8d935558f029be44bffdafa356246772272378afa27c33331cc6c5af91af56f59638237ea344df4f611d3572d68874434148a4b85bf03597043ebfc

Score
10/10
asyncratsdfypersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

SdFY

C2

registry.ddns.net:92

Mutex

Mutex_vbR93xAdsz09

Attributes
  • delay

    3

  • install

    false

  • install_file

    xplorer.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      37b4e4f5b9dde2fe83bba5b443d0cebb702aa14bf917749cdaaabb6ac7718997

    • Size

      745KB

    • MD5

      c23c612d444df3953d1c8bcf0c4bb1fe

    • SHA1

      6315707b722a4edda1b3c7d167284a9cabe96c26

    • SHA256

      37b4e4f5b9dde2fe83bba5b443d0cebb702aa14bf917749cdaaabb6ac7718997

    • SHA512

      a72f51c1d8d935558f029be44bffdafa356246772272378afa27c33331cc6c5af91af56f59638237ea344df4f611d3572d68874434148a4b85bf03597043ebfc

    Score
    10/10
    asyncratsdfypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks