Overview

overview

10

Static

static

10

a.ps1

windows7-x64

8

a.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a.ps1

  • Size

    567B

  • Sample

    220927-klzdnadad2

  • MD5

    b3cd9511ce088df0735164e5f5e7761e

  • SHA1

    7ce808db75239f6931c3551d8ba96cc6d668967d

  • SHA256

    5f19a9226fad05ac74b065bf8691daf121a04c33469e712e684dc9162e67b2fb

  • SHA512

    30a023f496fcc2b43b0aba8ce113293cb902c17a1ab3f85848ecf66d35309faae3ba4d148efa4753ea75bb3fc97369db85235cec36de0017e132eadedfe20e7b

Score
10/10
asyncratdefaultpersistencerat

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://pastbin.net/raw/installutil

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

zerocool888.duckdns.org:8848

zerocool888.duckdns.org:8898
Mutex

DcRatMutex_imlegion

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      a.ps1

    • Size

      567B

    • MD5

      b3cd9511ce088df0735164e5f5e7761e

    • SHA1

      7ce808db75239f6931c3551d8ba96cc6d668967d

    • SHA256

      5f19a9226fad05ac74b065bf8691daf121a04c33469e712e684dc9162e67b2fb

    • SHA512

      30a023f496fcc2b43b0aba8ce113293cb902c17a1ab3f85848ecf66d35309faae3ba4d148efa4753ea75bb3fc97369db85235cec36de0017e132eadedfe20e7b

    Score
    10/10
    asyncratdefaultpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks