Overview

overview

10

Static

static

1.scr

windows10-1703-x64

10

1.scr

windows7-x64

10

1.scr

windows10-2004-x64

1

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-12-2022 23:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.scr

  • Size

    360KB

  • MD5

    6bfdcc4ccf6fcecfaaa93d739a96fca4

  • SHA1

    522d5acd2038c3d041c81da3c7700f669266d0e6

  • SHA256

    63ac601ff1e5f4b6d85af85dda5948c2bbe54ace28efd3dae5deb7d7acf51b79

  • SHA512

    818cb68309c5d019e7d57850fbbddf45fcf09e63e5c30ed7979b96fa4766abf315595793839cfbfe8a3e91ad7ada1c52f0279ccf24617b81461a8692796f0f9d

  • SSDEEP

    1536:aok5ZSeS94jylSmuZxk2dlP43LTft9WP+by:aFmMfJZxk2dlTP+

Score
10/10
asyncrat默认rat

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    43.155.137.68
  • Port:
    21
  • Username:
    123
  • Password:
    123

Extracted

Family

asyncrat

Version

2022远程管理软件1.2

Botnet

默认

C2

134.122.167.65:8848

Mutex

实打啊大实低洼地打实大苏打aa

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.scr
    "C:\Users\Admin\AppData\Local\Temp\1.scr" /S
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2692-120-0x0000021B51080000-0x0000021B51096000-memory.dmp

    Filesize

    88KB

    Download