Overview

overview

10

Static

static

f206813414...f8.exe

windows7-x64

10

f206813414...f8.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f206813414d2040a855ca9074033777f3dfd2d4f1664e60c40df1963c8c972f8

  • Size

    734KB

  • Sample

    221125-l6jdlsdb71

  • MD5

    240a0e2f9ffa3e9e789ceb35a585ee14

  • SHA1

    e5d27dd1e90b4622f97bcfd72c81217f22157b3c

  • SHA256

    f206813414d2040a855ca9074033777f3dfd2d4f1664e60c40df1963c8c972f8

  • SHA512

    179173f3264af7b0eb68783691313aab3867fd4b4b19c051ecac31bb9aff9f6d98970ee18022f4e614bfaba32e1816663becb2239ecff1894e3808eae2cfb0f5

  • SSDEEP

    12288:5JD1+j2dKPX6Tub7lQLvvfqeo9DlzlPtST2bubBoBzLJZ7:5FTd0wub7avBulX9bCgLJZ

Score
10/10
asyncratdefaultpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

45.145.22.142:6606

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      f206813414d2040a855ca9074033777f3dfd2d4f1664e60c40df1963c8c972f8

    • Size

      734KB

    • MD5

      240a0e2f9ffa3e9e789ceb35a585ee14

    • SHA1

      e5d27dd1e90b4622f97bcfd72c81217f22157b3c

    • SHA256

      f206813414d2040a855ca9074033777f3dfd2d4f1664e60c40df1963c8c972f8

    • SHA512

      179173f3264af7b0eb68783691313aab3867fd4b4b19c051ecac31bb9aff9f6d98970ee18022f4e614bfaba32e1816663becb2239ecff1894e3808eae2cfb0f5

    • SSDEEP

      12288:5JD1+j2dKPX6Tub7lQLvvfqeo9DlzlPtST2bubBoBzLJZ7:5FTd0wub7avBulX9bCgLJZ

    Score
    10/10
    asyncratdefaultpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks