Overview

overview

10

Static

static

9f3169004f...d2.exe

windows7-x64

10

9f3169004f...d2.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f3169004f468804b94ec9c9b8a58b30d9853e8be06ebd7d3d3ea8ca18df6fd2

  • Size

    41KB

  • Sample

    221130-p8e1racc53

  • MD5

    cf9acdeb824bb9df6a31761b8dbc487f

  • SHA1

    e6585c92833fd710920d738f791341c05852bfeb

  • SHA256

    9f3169004f468804b94ec9c9b8a58b30d9853e8be06ebd7d3d3ea8ca18df6fd2

  • SHA512

    ba78e9f6c26b2900b20853a6287b0dc6f27b7683317d1cf304cc0ad9decb7cad8b56299b408540399ecc9184afaee61ec485024580499cb48d28dfaba6805ce8

  • SSDEEP

    768:7YOYRRNa5FN36puc1C2jT6zhcUDTZxmEyNnyWWaq2:LScx6puOLjT+hcUnA8WVx

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

207.32.216.106:6606

207.32.216.106:7707

207.32.216.106:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    WinSecurity.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      9f3169004f468804b94ec9c9b8a58b30d9853e8be06ebd7d3d3ea8ca18df6fd2

    • Size

      41KB

    • MD5

      cf9acdeb824bb9df6a31761b8dbc487f

    • SHA1

      e6585c92833fd710920d738f791341c05852bfeb

    • SHA256

      9f3169004f468804b94ec9c9b8a58b30d9853e8be06ebd7d3d3ea8ca18df6fd2

    • SHA512

      ba78e9f6c26b2900b20853a6287b0dc6f27b7683317d1cf304cc0ad9decb7cad8b56299b408540399ecc9184afaee61ec485024580499cb48d28dfaba6805ce8

    • SSDEEP

      768:7YOYRRNa5FN36puc1C2jT6zhcUDTZxmEyNnyWWaq2:LScx6puOLjT+hcUnA8WVx

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks