Overview

overview

10

Static

static

399a0e7732...03.exe

windows7-x64

10

399a0e7732...03.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    399a0e77326dc484fa92fd5f95f2dbd89866dfd4e7e80661634a9a83f0652403

  • Size

    8.6MB

  • Sample

    221212-vs5jcsca38

  • MD5

    ec6f3b1f5b9b24da2b68603d8ec7248a

  • SHA1

    cd268bbca51c8c8675cf07da2a81759098983f2c

  • SHA256

    32bda5e7ca2938742abc46aded1d6e8a6ed16135a4628da2ec96f2b625979875

  • SHA512

    25cc73b08fa62b3df5d91eb1b0f72c34de853489a825d3059329c2aca5e5752712953cd07c97d2cf5d9942c0c72f8ec263c65c203d21114eb99f076765a11677

  • SSDEEP

    196608:poRNmquRPxYHDrpVMYrBvLAOM/4WyrOOYSphRBrn6:yRkbRp6bMYrBUOM/4W4OOYM1r6

Score
10/10
asyncratsystem guard runtimerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

System Guard Runtime

C2

85.105.88.221:2531

Mutex

System Guard Runtime

Attributes
  • delay

    3

  • install

    false

  • install_file

    System Guard Runtime

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      399a0e77326dc484fa92fd5f95f2dbd89866dfd4e7e80661634a9a83f0652403

    • Size

      14.7MB

    • MD5

      2cbd5d9d43c5c49f0580975e9e620808

    • SHA1

      17e209b6d6c66882ed78a40d7e0d211760b489a0

    • SHA256

      399a0e77326dc484fa92fd5f95f2dbd89866dfd4e7e80661634a9a83f0652403

    • SHA512

      26e06d3d3b4f8d1198f483e2485ee107782c7f5b70ddb4d48dd84c9ef81029af316ad3a184c90921c6f1188f92d88b9fd6a152eaba5648a03bfbdea589202812

    • SSDEEP

      196608:X0hLU8m9T9crlNBd8Sbrlzg0IzM7djVK2:khA595q38SbBs0IzM3

    Score
    10/10
    asyncratsystem guard runtimerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks