Overview

overview

10

Static

static

9dbb9ba5a0...7d.exe

windows7-x64

10

9dbb9ba5a0...7d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9dbb9ba5a01a654a21d899aef6594ee5fc0b4d0ac68a3c97ec52ef6a8959f27d

  • Size

    562KB

  • Sample

    221130-th7ejaha6z

  • MD5

    430e7cce721d74347a9a7ac87a9a9ec1

  • SHA1

    b03b248c279d9e05988c0cd87aa405e9ae55f0e2

  • SHA256

    9dbb9ba5a01a654a21d899aef6594ee5fc0b4d0ac68a3c97ec52ef6a8959f27d

  • SHA512

    69ad4bd2e3ac61d596ae4ab65abe41128bf8a74cd7366f5f6584d1bccdb4e6ef6ae95dc846917a1fb5fc2fcb680ebcd677b85444e5b7f0c663381885edf5fc0b

  • SSDEEP

    12288:X63MOeq3A7EEqsGh3S8CbZJscjIcKvKJNY8lYfIeXQhzMhi1:X21e6yqsGNdCbZeZo8AhzM41

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

mr7bashbab.ddns.net:6606

mr7bashbab.ddns.net:7707

mr7bashbab.ddns.net:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    OBS.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      9dbb9ba5a01a654a21d899aef6594ee5fc0b4d0ac68a3c97ec52ef6a8959f27d

    • Size

      562KB

    • MD5

      430e7cce721d74347a9a7ac87a9a9ec1

    • SHA1

      b03b248c279d9e05988c0cd87aa405e9ae55f0e2

    • SHA256

      9dbb9ba5a01a654a21d899aef6594ee5fc0b4d0ac68a3c97ec52ef6a8959f27d

    • SHA512

      69ad4bd2e3ac61d596ae4ab65abe41128bf8a74cd7366f5f6584d1bccdb4e6ef6ae95dc846917a1fb5fc2fcb680ebcd677b85444e5b7f0c663381885edf5fc0b

    • SSDEEP

      12288:X63MOeq3A7EEqsGh3S8CbZJscjIcKvKJNY8lYfIeXQhzMhi1:X21e6yqsGNdCbZeZo8AhzM41

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks