Overview

overview

10

Static

static

WindowsDef...en.exe

windows7-x64

10

WindowsDef...en.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WindowsDefenderSmarttScreen.exe

  • Size

    4.2MB

  • Sample

    221108-z62rvabbar

  • MD5

    b60e44033994d1fde9a4b6f1338bfa04

  • SHA1

    7f2cd8091276040ca011174269112099ec3e9bef

  • SHA256

    baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e

  • SHA512

    a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574

  • SSDEEP

    49152:Zsblud53xMQg3Q3cX5C/wnvdAlPjcmYDIYqDsfgVi:Zspuff721

Score
10/10
asyncratwindowsdefendersmarttscreenpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

WindowsDefenderSmarttScreen

C2

217.64.31.3:9742

Mutex

WindowsDefenderSmarttScreen

Attributes
  • delay

    1

  • install

    false

  • install_file

    WindowsDefenderSmarttScreen.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      WindowsDefenderSmarttScreen.exe

    • Size

      4.2MB

    • MD5

      b60e44033994d1fde9a4b6f1338bfa04

    • SHA1

      7f2cd8091276040ca011174269112099ec3e9bef

    • SHA256

      baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e

    • SHA512

      a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574

    • SSDEEP

      49152:Zsblud53xMQg3Q3cX5C/wnvdAlPjcmYDIYqDsfgVi:Zspuff721

    Score
    10/10
    asyncratwindowsdefendersmarttscreenpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks