asyncrat | d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9 | Triage

Sharing

General

Target

d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9
Size

6KB
Sample

221205-hcdpgsdg22
MD5

378deda0d1313deba917adfc74173962
SHA1

cb466cdd64949febdaaae75625d5a3ce0fff6e35
SHA256

d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9
SHA512

c1411ed00aeb88b6f92702132d20dac2efacd90e79aee697e1e0431353638353a5f9fa6b575676e0426f1434cede0f59e58559822cc45067893a30f6b8300281
SSDEEP

96:Ck79rll3VI2St01vk+Al5tONtUqvkC4muMs6d3oj0dirl:J9r/33SCvkRgNtUqvkBmm6dNdq

Score

10^/10

asyncrat system guard runtime rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

System Guard Runtime

C2

85.105.88.221:2531

Mutex

System Guard Runtime

Attributes

delay
3
install
false
install_file
System Guard Runtime
install_folder
%AppData%

aes.plain

Targets

- Target
  
  d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9
- Size
  
  6KB
- MD5
  
  378deda0d1313deba917adfc74173962
- SHA1
  
  cb466cdd64949febdaaae75625d5a3ce0fff6e35
- SHA256
  
  d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9
- SHA512
  
  c1411ed00aeb88b6f92702132d20dac2efacd90e79aee697e1e0431353638353a5f9fa6b575676e0426f1434cede0f59e58559822cc45067893a30f6b8300281
- SSDEEP
  
  96:Ck79rll3VI2St01vk+Al5tONtUqvkC4muMs6d3oj0dirl:J9r/33SCvkRgNtUqvkBmm6dNdq
Score

10^/10

asyncrat system guard runtime rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Async RAT payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

asyncratsystem guard runtimerat