Overview

overview

10

Static

static

ScanCopy37...cr.exe

windows7-x64

10

ScanCopy37...cr.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ScanCopy378493rh1.scr.exe

  • Size

    1.0MB

  • Sample

    220909-p872jacacr

  • MD5

    c5da839b1c6505b50f9d18588bc29dcc

  • SHA1

    808bcb8114f6188448b06ef581965e6ee09d4562

  • SHA256

    af51aadc7d93eea0355ed2605959052333a0e124753ff5df78d16bcbf5031fbe

  • SHA512

    03cc401161ae408e0b585aee60db9caec298a9f69cd5b1323417dc49771cceb7df3711886542ca7add6ff62091c83b0ae127c26ea2f4112ca6f84edff4e7952d

  • SSDEEP

    12288:7SDJuxq0TA5FCxv2eP0Kla6EMAXmnSBY5eUk4MVYolDfyWEYjms8hV:7S9RK4i0p9r2iYDcmy3qs8hV

Score
10/10
asyncratijefundsrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

Ijefunds

C2

79.134.225.20:8808

Mutex

mmkawdairhcehilxluo

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ScanCopy378493rh1.scr.exe

    • Size

      1.0MB

    • MD5

      c5da839b1c6505b50f9d18588bc29dcc

    • SHA1

      808bcb8114f6188448b06ef581965e6ee09d4562

    • SHA256

      af51aadc7d93eea0355ed2605959052333a0e124753ff5df78d16bcbf5031fbe

    • SHA512

      03cc401161ae408e0b585aee60db9caec298a9f69cd5b1323417dc49771cceb7df3711886542ca7add6ff62091c83b0ae127c26ea2f4112ca6f84edff4e7952d

    • SSDEEP

      12288:7SDJuxq0TA5FCxv2eP0Kla6EMAXmnSBY5eUk4MVYolDfyWEYjms8hV:7S9RK4i0p9r2iYDcmy3qs8hV

    Score
    10/10
    asyncratijefundsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks