Overview

overview

10

Static

static

3a8c396709...2f.exe

windows7-x64

10

3a8c396709...2f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a8c396709d693d9a6056b74722088ceb5881b93765df71f7124b1756bb7e72f

  • Size

    49.0MB

  • Sample

    221220-rw77wadb4w

  • MD5

    29dbcafd5b93edc917ec738221a4d62d

  • SHA1

    5ef0337f89afaa36072a5bd9a670fdf7c9b7535a

  • SHA256

    3a8c396709d693d9a6056b74722088ceb5881b93765df71f7124b1756bb7e72f

  • SHA512

    800c0efd66509a8fa0816c47f061faf6b01a23b673d98495d2a5412d500feda502f9d7fdfb63a8a05948032fed1b9b63744db9cc0db6c78a1aa97840fca0ed76

  • SSDEEP

    1572864:lJFzuWZZPyH0G/bJafhqikT1M2cgY/Dx2F91jn:lPrZZPyH0mQgikT11cgY/DxG7

Score
10/10
asyncratcoreentitydiscoveryrat

Malware Config

Targets

    • Target

      3a8c396709d693d9a6056b74722088ceb5881b93765df71f7124b1756bb7e72f

    • Size

      49.0MB

    • MD5

      29dbcafd5b93edc917ec738221a4d62d

    • SHA1

      5ef0337f89afaa36072a5bd9a670fdf7c9b7535a

    • SHA256

      3a8c396709d693d9a6056b74722088ceb5881b93765df71f7124b1756bb7e72f

    • SHA512

      800c0efd66509a8fa0816c47f061faf6b01a23b673d98495d2a5412d500feda502f9d7fdfb63a8a05948032fed1b9b63744db9cc0db6c78a1aa97840fca0ed76

    • SSDEEP

      1572864:lJFzuWZZPyH0G/bJafhqikT1M2cgY/Dx2F91jn:lPrZZPyH0mQgikT11cgY/DxG7

    Score
    10/10
    asyncratcoreentitydiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks