Overview

overview

10

Static

static

baaa098832...7e.exe

windows7-x64

10

baaa098832...7e.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e

  • Size

    1.6MB

  • Sample

    221212-16lajafe6t

  • MD5

    e2795d6f8ff704a56cb3e1f12ae5b17b

  • SHA1

    b48ab1dd418af2f4c7ec5bb4fa51b3f75b01e3b5

  • SHA256

    7678ac2f55d143b5dcd51d01c11c2bbec0258951b4d462ad8afcf88eb12ccb92

  • SHA512

    eb6723b4f571660bbe5e519a02592a1cbd7a06e13a7c6826851d22cd1d3d17f9b2e7c8b7280cac54b50e50e755f7025f6d905a3baf7551c1996873aa07e9a82e

  • SSDEEP

    49152:kiIWRIWq6/tcvjAlWZBja19hOW7ym1IfWTib:khmIWHtcvjyUBmnhP7HsDb

Score
10/10
asyncratwindowsdefendersmarttscreenpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

WindowsDefenderSmarttScreen

C2

217.64.31.3:9742

Mutex

WindowsDefenderSmarttScreen

Attributes
  • delay

    1

  • install

    false

  • install_file

    WindowsDefenderSmarttScreen.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e

    • Size

      4.2MB

    • MD5

      b60e44033994d1fde9a4b6f1338bfa04

    • SHA1

      7f2cd8091276040ca011174269112099ec3e9bef

    • SHA256

      baaa098832eb5790a1fabfdc6284eecffdd74a914ea1312c0f413cc5bb814a7e

    • SHA512

      a8776d7ce2bffa25cefe789bf8f5a4b5b0b81ef53cd0c783ded1be9ee0f976c6c2a3bd41a4d9c05eb15910051d3cfe490c6390b7029d370ad71487c88416c574

    • SSDEEP

      49152:Zsblud53xMQg3Q3cX5C/wnvdAlPjcmYDIYqDsfgVi:Zspuff721

    Score
    10/10
    asyncratwindowsdefendersmarttscreenpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks