asyncrat | 7bb432c0ac0cf65de6c795685a41b1478f9d979e2b05bd9c8fb11725f9942e01 | Triage

Analysis

max time kernel
199s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2022 11:00

Sharing

Report Analysis Logs

General

Target

pack/AfMaR.exe
Size

45KB
MD5

a23c5f26bb7a11952d408d99242e5c06
SHA1

0712a50bbb25a1803df9e9f7fd195ed86f54d1a7
SHA256

d140f6813ba550ee767cdcac73ea9f38868e6e3653289b7f0f49d04db65860c0
SHA512

4955d486cb75050c702877ac6d4ea26b0328cb8978e2854b1fd06fd62c9f98a89918e78ed66caedf3459b6fb542fba170e98e0d4e0940a6a65384b75d0830b47

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

192.168.1.4:6606

192.168.1.4:7707

192.168.1.4:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral18/memory/1492-130-0x0000000000110000-0x0000000000122000-memory.dmp	asyncrat

C:\Users\Admin\AppData\Local\Temp\pack\AfMaR.exe
"C:\Users\Admin\AppData\Local\Temp\pack\AfMaR.exe"
1⤵
PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-130-0x0000000000110000-0x0000000000122000-memory.dmp

Filesize
72KB

Download