Overview

overview

10

Static

static

399a0e7732...03.exe

windows7-x64

10

399a0e7732...03.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    399a0e77326dc484fa92fd5f95f2dbd89866dfd4e7e80661634a9a83f0652403

  • Size

    8.6MB

  • Sample

    221212-1zkqescg74

  • MD5

    ba169f622a785c432d7845eb43126ecb

  • SHA1

    cf07452f8c19933c04667001d0260e4b0e84e5da

  • SHA256

    f6d5ea83aaaf2ca9a161157d1c87697bbeed9818c3d148dd1ef421884637cf36

  • SHA512

    c70e7b78e319a9e870f596f3a0d8eb3cc5b4d6d23f870beddcf7a641c41aaa2b93ca82d66c5321892560bcebfa7b05adc416de99028a82ab3adfdd75d98baa19

  • SSDEEP

    196608:UoRNmquRPxYHDrpVMYrBvLAOM/4WyrOOYSphRBrnP:bRkbRp6bMYrBUOM/4W4OOYM1rP

Score
10/10
asyncratsystem guard runtimerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

System Guard Runtime

C2

85.105.88.221:2531

Mutex

System Guard Runtime

Attributes
  • delay

    3

  • install

    false

  • install_file

    System Guard Runtime

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      399a0e77326dc484fa92fd5f95f2dbd89866dfd4e7e80661634a9a83f0652403

    • Size

      14.7MB

    • MD5

      2cbd5d9d43c5c49f0580975e9e620808

    • SHA1

      17e209b6d6c66882ed78a40d7e0d211760b489a0

    • SHA256

      399a0e77326dc484fa92fd5f95f2dbd89866dfd4e7e80661634a9a83f0652403

    • SHA512

      26e06d3d3b4f8d1198f483e2485ee107782c7f5b70ddb4d48dd84c9ef81029af316ad3a184c90921c6f1188f92d88b9fd6a152eaba5648a03bfbdea589202812

    • SSDEEP

      196608:X0hLU8m9T9crlNBd8Sbrlzg0IzM7djVK2:khA595q38SbBs0IzM3

    Score
    10/10
    asyncratsystem guard runtimerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks