Overview

overview

10

Static

static

ac0c1c0379...1a.ps1

windows7-x64

1

ac0c1c0379...1a.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac0c1c0379a7f97283829cd57f8848b8ebf9cc819952c9792124eae4fc08e71a

  • Size

    327KB

  • Sample

    221209-s5c9jagd2v

  • MD5

    1356a90b675211989a87a48f3b27537e

  • SHA1

    c5f8c3c3ac577f8ccd8b27ee97543f48f96f6cda

  • SHA256

    ac0c1c0379a7f97283829cd57f8848b8ebf9cc819952c9792124eae4fc08e71a

  • SHA512

    5459e4ec6144bb160ca5a4657c2e233880ebd5ab17573e03ab184fb8b189fbf5b7f90b27e88374a9d5c6fbc96d1e23a0d33ada4abfdb2cc7905ab0682fd7398b

  • SSDEEP

    3072:9j68V2ldvzD3t3ApYjK+bXMUm+I4t/qKKlUkyZWdV:9+m2TzD3t3ApYjKiXlICqKKlUlZWdV

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

185.81.157.19:3312

ns1usaupload.myphotos.cc:3312
Mutex

AsyncMutex_6SI8OkPnkAAA

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ac0c1c0379a7f97283829cd57f8848b8ebf9cc819952c9792124eae4fc08e71a

    • Size

      327KB

    • MD5

      1356a90b675211989a87a48f3b27537e

    • SHA1

      c5f8c3c3ac577f8ccd8b27ee97543f48f96f6cda

    • SHA256

      ac0c1c0379a7f97283829cd57f8848b8ebf9cc819952c9792124eae4fc08e71a

    • SHA512

      5459e4ec6144bb160ca5a4657c2e233880ebd5ab17573e03ab184fb8b189fbf5b7f90b27e88374a9d5c6fbc96d1e23a0d33ada4abfdb2cc7905ab0682fd7398b

    • SSDEEP

      3072:9j68V2ldvzD3t3ApYjK+bXMUm+I4t/qKKlUkyZWdV:9+m2TzD3t3ApYjKiXlICqKKlUlZWdV

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks