Overview

overview

10

Static

static

office.ps1

windows10-1703-x64

10

office.ps1

windows7-x64

10

office.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    office.ps1

  • Size

    172KB

  • Sample

    221215-gylrjseg6z

  • MD5

    40113b90033a17620cfab836e01c208e

  • SHA1

    8b752278316f5af828ddf23f62d4b6d6c0591e6e

  • SHA256

    ae60268e3dae5ed2ecb06c47642bb33cd4f79d0b980476f1a7c931e2a4ba32ca

  • SHA512

    83d55d3e4c898b35879774a7ec469bfb33598ad0adec08012cedef170fc32515bd2d0378d4ffb658ca5eaa95187b65c46b7645a233990aae4c971e5e2bf95e5e

  • SSDEEP

    1536:DYrP7b2WPgkSqZkjEHcFJXiKTClpXcclUXdCXxEbr7IlWMQvVhB8LCZsHXGwrAfO:D30

Score
10/10
asyncrat99rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

99

C2

d1x3x.linkpc.net:6666

d1x3x.dyndns.org:6666

d1x3x.selfip.biz:6666
Mutex

AsyncMutex_Devil

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      office.ps1

    • Size

      172KB

    • MD5

      40113b90033a17620cfab836e01c208e

    • SHA1

      8b752278316f5af828ddf23f62d4b6d6c0591e6e

    • SHA256

      ae60268e3dae5ed2ecb06c47642bb33cd4f79d0b980476f1a7c931e2a4ba32ca

    • SHA512

      83d55d3e4c898b35879774a7ec469bfb33598ad0adec08012cedef170fc32515bd2d0378d4ffb658ca5eaa95187b65c46b7645a233990aae4c971e5e2bf95e5e

    • SSDEEP

      1536:DYrP7b2WPgkSqZkjEHcFJXiKTClpXcclUXdCXxEbr7IlWMQvVhB8LCZsHXGwrAfO:D30

    Score
    10/10
    asyncrat99rat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks