Malware sandboxing report by Hatching Triage

General

Target

5e0bb71d8b20adb1d6e0ca500c3a6d33cf74b529a784ec0c45a65565f86d9465
Size

45KB
Sample

221205-we7x1abh36
MD5

4c6a8c27659c19e8becc16fe49ee0ada
SHA1

b82626b423671ef14c0d92ad2bcd4ac1d22173f2
SHA256

5e0bb71d8b20adb1d6e0ca500c3a6d33cf74b529a784ec0c45a65565f86d9465
SHA512

e3df433a6ee4141c14feb4b714b4615c898dd37976c186c878513659ceacc25f31affe15569aadd7c4f085f741127b999acae9625d44eb62d6a39efc7be2f1d8
SSDEEP

768:OuxEJTVmU5EkWUGBKSmo2q1SKjGKG6PIyzjbFgX3icd3kORCO4BDZgx:OuxEJTgim2dKYDy3bCXScAO+dgx

Score

10^/10

Malware Config

Extracted

Family	asyncrat
Version	0.5.7B
Botnet	Default
C2	127.0.0.1:6606 127.0.0.1:7707 127.0.0.1:8808 127.0.0.1:51115 127.0.0.1:26993 127.0.0.1:19624 127.0.0.1:12336 185.246.220.26:6606 185.246.220.26:7707 185.246.220.26:8808 185.246.220.26:51115 185.246.220.26:26993 185.246.220.26:19624 185.246.220.26:12336 5.tcp.ngrok.io:6606 5.tcp.ngrok.io:7707 5.tcp.ngrok.io:8808 5.tcp.ngrok.io:51115 5.tcp.ngrok.io:26993 5.tcp.ngrok.io:19624 5.tcp.ngrok.io:12336 disownnet.duckdns.org:6606 disownnet.duckdns.org:7707 disownnet.duckdns.org:8808 disownnet.duckdns.org:51115 disownnet.duckdns.org:26993 disownnet.duckdns.org:19624 disownnet.duckdns.org:12336 7.tcp.eu.ngrok.io:6606 7.tcp.eu.ngrok.io:7707 7.tcp.eu.ngrok.io:8808 7.tcp.eu.ngrok.io:51115 7.tcp.eu.ngrok.io:26993 7.tcp.eu.ngrok.io:19624 7.tcp.eu.ngrok.io:12336 6.tcp.eu.ngrok.io::6606 6.tcp.eu.ngrok.io::7707 6.tcp.eu.ngrok.io::8808 6.tcp.eu.ngrok.io::51115 6.tcp.eu.ngrok.io::26993 6.tcp.eu.ngrok.io::19624 6.tcp.eu.ngrok.io::12336 127.0.0.1:6606 127.0.0.1:7707 127.0.0.1:8808 127.0.0.1:51115 127.0.0.1:26993 127.0.0.1:19624 127.0.0.1:12336 185.246.220.26:6606 185.246.220.26:7707 185.246.220.26:8808 185.246.220.26:51115 185.246.220.26:26993 185.246.220.26:19624 185.246.220.26:12336 5.tcp.ngrok.io:6606 5.tcp.ngrok.io:7707 5.tcp.ngrok.io:8808 5.tcp.ngrok.io:51115 5.tcp.ngrok.io:26993 5.tcp.ngrok.io:19624 5.tcp.ngrok.io:12336 disownnet.duckdns.org:6606 disownnet.duckdns.org:7707 disownnet.duckdns.org:8808 disownnet.duckdns.org:51115 disownnet.duckdns.org:26993 disownnet.duckdns.org:19624 disownnet.duckdns.org:12336 7.tcp.eu.ngrok.io:6606 7.tcp.eu.ngrok.io:7707 7.tcp.eu.ngrok.io:8808 7.tcp.eu.ngrok.io:51115 7.tcp.eu.ngrok.io:26993 7.tcp.eu.ngrok.io:19624 7.tcp.eu.ngrok.io:12336 6.tcp.eu.ngrok.io::6606 6.tcp.eu.ngrok.io::7707 6.tcp.eu.ngrok.io::8808 6.tcp.eu.ngrok.io::51115 6.tcp.eu.ngrok.io::26993 6.tcp.eu.ngrok.io::19624 6.tcp.eu.ngrok.io::12336
Attributes	delay 3 install false install_file services.exe install_folder %AppData%
aes.plain

Targets

- Target
  
  5e0bb71d8b20adb1d6e0ca500c3a6d33cf74b529a784ec0c45a65565f86d9465
- Size
  
  45KB
- MD5
  
  4c6a8c27659c19e8becc16fe49ee0ada
- SHA1
  
  b82626b423671ef14c0d92ad2bcd4ac1d22173f2
- SHA256
  
  5e0bb71d8b20adb1d6e0ca500c3a6d33cf74b529a784ec0c45a65565f86d9465
- SHA512
  
  e3df433a6ee4141c14feb4b714b4615c898dd37976c186c878513659ceacc25f31affe15569aadd7c4f085f741127b999acae9625d44eb62d6a39efc7be2f1d8
- SSDEEP
  
  768:OuxEJTVmU5EkWUGBKSmo2q1SKjGKG6PIyzjbFgX3icd3kORCO4BDZgx:OuxEJTgim2dKYDy3bCXScAO+dgx
Score

10^/10

asyncrat default rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Async RAT payload
  rat
behavioral1

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks

static1

ratdefaultasyncrat

Score

10^/10

behavioral1

asyncratdefaultrat

Score

10^/10

Sharing

General

Malware Config

Extracted

Targets

AsyncRat

Async RAT payload

MITRE ATT&CK Matrix

Tasks

static1

behavioral1