Overview

overview

10

Static

static

server1.exe

windows7_x64

10

server1.exe

windows10-2004_x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    server1.bin

  • Size

    143KB

  • Sample

    220708-lw79zsdeg8

  • MD5

    e52ddd261cbf8498daf41a433ca226f9

  • SHA1

    4ce315c5b0b71fbbed5f6fe71bcbd6dc0a122c74

  • SHA256

    ef5f3901e4c087cb3eae06e643a0ce9c3b3beef59e799d72b05592b7471c8ecd

  • SHA512

    1a0053eb789e1de612bf4176019f1ed9c74551ffb5715ec0db54917deb82b6ba491733f5c924679a1f36f54cad356907f525be6ca64dca5064299ef475766b8c

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

venelix.duckdns.org:6606

venelix.duckdns.org:7707

venelix.duckdns.org:8808

192.168.1.5:6606

192.168.1.5:7707

192.168.1.5:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      server1.bin

    • Size

      143KB

    • MD5

      e52ddd261cbf8498daf41a433ca226f9

    • SHA1

      4ce315c5b0b71fbbed5f6fe71bcbd6dc0a122c74

    • SHA256

      ef5f3901e4c087cb3eae06e643a0ce9c3b3beef59e799d72b05592b7471c8ecd

    • SHA512

      1a0053eb789e1de612bf4176019f1ed9c74551ffb5715ec0db54917deb82b6ba491733f5c924679a1f36f54cad356907f525be6ca64dca5064299ef475766b8c

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks