Overview

overview

10

Static

static

logolol.ps1

windows7-x64

1

logolol.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    logolol.ps1

  • Size

    187KB

  • Sample

    221009-slqqhshcdr

  • MD5

    a345138c96b8d5b50e401192b819d49d

  • SHA1

    bdcc4ef88b1d5377409ad2f45fcb4e04d8fba5c3

  • SHA256

    aaf4a4acaa8e45b1cbd8a3da7c988ba6465a3a2a714abaacb632230e91556d28

  • SHA512

    942d48b221dbe2a67b9edc5992aef3a54438befe715ded5996437b17ed2ccad1c647b74273792567819c3cca8f95940595cbd8e25d9c6a43c391452770c77bed

  • SSDEEP

    3072:ngijttzaOYYzmqIzDNSuoT3ApmNwLqU/QIU:nT/zaOYYz4zDNo3Apm6qU/QIU

Score
10/10
asyncrataaaaaaaaaaaa+++aaaaaaaaaaaarat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

AAAAAAAAAAAA+++AAAAAAAAAAAA

C2

chromedata.accesscam.org:7707

chromedata.accesscam.org:4404

chromedata.accesscam.org:5505

chromedata.accesscam.org:3303

chromedata.accesscam.org:2222

chromedata.accesscam.org:6606

chromedata.accesscam.org:8808

chromedata.accesscam.org:5155

chromedata.accesscam.org:5122

chromedata.accesscam.org:8001

chromedata.accesscam.org:9000

chromedata.accesscam.org:9999

chromedata.accesscam.org:8888

cdt.3utilities.com:7707

cdt.3utilities.com:4404

cdt.3utilities.com:5505

cdt.3utilities.com:3303

cdt.3utilities.com:2222

cdt.3utilities.com:6606

cdt.3utilities.com:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    DesbravadorUpdata.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      logolol.ps1

    • Size

      187KB

    • MD5

      a345138c96b8d5b50e401192b819d49d

    • SHA1

      bdcc4ef88b1d5377409ad2f45fcb4e04d8fba5c3

    • SHA256

      aaf4a4acaa8e45b1cbd8a3da7c988ba6465a3a2a714abaacb632230e91556d28

    • SHA512

      942d48b221dbe2a67b9edc5992aef3a54438befe715ded5996437b17ed2ccad1c647b74273792567819c3cca8f95940595cbd8e25d9c6a43c391452770c77bed

    • SSDEEP

      3072:ngijttzaOYYzmqIzDNSuoT3ApmNwLqU/QIU:nT/zaOYYz4zDNo3Apm6qU/QIU

    Score
    10/10
    asyncrataaaaaaaaaaaa+++aaaaaaaaaaaarat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks