Overview

overview

10

Static

static

vlc.exe

windows7-x64

10

vlc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vlc.exe

  • Size

    83KB

  • Sample

    221203-l9v7ksef9x

  • MD5

    56908392d21ec7d8be04f7bbd59732c2

  • SHA1

    c864ef983e05ec65fcb4c9ef19444eef8728cc2b

  • SHA256

    80f785a35f7487df96bb17b1fe2a67f188417ad017db8efac8d83b3858efcd96

  • SHA512

    6d6aa7cc3bc963d8c0ed2eca6250f6a09ca69228704dabf5998bf8069708fbe4739a8e4ca47086cd937984b58c029af239442ac6227335320e51fc6d40e9e981

  • SSDEEP

    1536:msGVpglGkHHFwPtwKOl2Dp+jZuMzJAGdjl:NV9OFtOAQQMzJVdjl

Score
10/10
asyncratdefaultpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

2.58.56.22:5211

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_file

    Spoofer.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      vlc.exe

    • Size

      83KB

    • MD5

      56908392d21ec7d8be04f7bbd59732c2

    • SHA1

      c864ef983e05ec65fcb4c9ef19444eef8728cc2b

    • SHA256

      80f785a35f7487df96bb17b1fe2a67f188417ad017db8efac8d83b3858efcd96

    • SHA512

      6d6aa7cc3bc963d8c0ed2eca6250f6a09ca69228704dabf5998bf8069708fbe4739a8e4ca47086cd937984b58c029af239442ac6227335320e51fc6d40e9e981

    • SSDEEP

      1536:msGVpglGkHHFwPtwKOl2Dp+jZuMzJAGdjl:NV9OFtOAQQMzJVdjl

    Score
    10/10
    asyncratdefaultpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks