Overview

overview

10

Static

static

63F13767CD...3C.exe

windows7-x64

10

63F13767CD...3C.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63F13767CD38209385164D5517A55A6846996268F7C3C.exe

  • Size

    900KB

  • Sample

    221126-ghv1aaae51

  • MD5

    a494a81f17b65fca1bdbb853b6556172

  • SHA1

    71ea522b0832d85875432842ff55f337e4a08081

  • SHA256

    63f13767cd38209385164d5517a55a6846996268f7c3ca03bbb8c4129259b4b9

  • SHA512

    aeb70d879e94101476697420991a9236670297c0793ca16399aa80e9c75bfb9b347a95b723245555c0a6c039e7a001dbd8ed378acbca589eafbd3d66a585a3a9

  • SSDEEP

    12288:M6qjziyoNL4bVwBJ4pKhYKgWD4qH4JuteNqvRH5IYtwpjgFp:Mdj4L48J7qKx0MrZH5IYtdp

Score
10/10
asyncratredlineinfostealerrat

Malware Config

Targets

    • Target

      63F13767CD38209385164D5517A55A6846996268F7C3C.exe

    • Size

      900KB

    • MD5

      a494a81f17b65fca1bdbb853b6556172

    • SHA1

      71ea522b0832d85875432842ff55f337e4a08081

    • SHA256

      63f13767cd38209385164d5517a55a6846996268f7c3ca03bbb8c4129259b4b9

    • SHA512

      aeb70d879e94101476697420991a9236670297c0793ca16399aa80e9c75bfb9b347a95b723245555c0a6c039e7a001dbd8ed378acbca589eafbd3d66a585a3a9

    • SSDEEP

      12288:M6qjziyoNL4bVwBJ4pKhYKgWD4qH4JuteNqvRH5IYtwpjgFp:Mdj4L48J7qKx0MrZH5IYtdp

    Score
    10/10
    asyncratredlineinfostealerrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks