asyncrat

Sharing

Copy URL

Twitter E-mail

General

Target

2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Size

2.2MB
Sample

220819-edz3bsagh6
MD5

b5f1a37cbd6c8a4690942fd254270ce1
SHA1

e31e9c0d978a340445572bbb4b07fd2d5f9cb6ec
SHA256

2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e
SHA512

6a7a39a9511d3bbe42a90d0a8c6a7e97d6427b8d68fc303b1b6dc2c3737ba7c875ccf44683ca792aab92daba43ffea32da93066acb64005f2e7532ce011b6996
SSDEEP

49152:TVBo0YkPwdB3sV2F2sp577xAKDqeQ5LfJuRd:oson8gkI5x7DqeQJkX

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

76.8.53.133:62520

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
dwwm.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
- Size
  
  2.2MB
- MD5
  
  b5f1a37cbd6c8a4690942fd254270ce1
- SHA1
  
  e31e9c0d978a340445572bbb4b07fd2d5f9cb6ec
- SHA256
  
  2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e
- SHA512
  
  6a7a39a9511d3bbe42a90d0a8c6a7e97d6427b8d68fc303b1b6dc2c3737ba7c875ccf44683ca792aab92daba43ffea32da93066acb64005f2e7532ce011b6996
- SSDEEP
  
  49152:TVBo0YkPwdB3sV2F2sp577xAKDqeQ5LfJuRd:oson8gkI5x7DqeQJkX
Score

10^/10

asyncrat default persistence rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Async RAT payload
  rat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9 behavioral10 behavioral11 behavioral12

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Async RAT payload

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12