Overview

overview

10

Static

static

invoice.bat

windows7-x64

8

invoice.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    invoice.bat

  • Size

    49KB

  • Sample

    230119-qb442sda21

  • MD5

    36753b61c8e886f0f49388f72b2435ac

  • SHA1

    20c308298c338520543e4c272b2cd2901bd7cb52

  • SHA256

    12c87ccc8c293657e41d39202a8ccc02a106ee4128769957d42a206019fcf20d

  • SHA512

    cc11219fa92b219d33cd111258fcbda65f02479d06b35c7589040fd9fafff0c842a50f690ad30046eb2e530cb5fbaca3b8ae1c7e23291aeaab4e9acafd5bdc82

  • SSDEEP

    768:F8TRp7qCDMI3IbV+qks5F9x+OZmDFBeTUjG1qEsbae4/evfI4yu/:2utIQ95FbCDFEUBR

Score
10/10
asyncratratspywarestealer

Malware Config

Targets

    • Target

      invoice.bat

    • Size

      49KB

    • MD5

      36753b61c8e886f0f49388f72b2435ac

    • SHA1

      20c308298c338520543e4c272b2cd2901bd7cb52

    • SHA256

      12c87ccc8c293657e41d39202a8ccc02a106ee4128769957d42a206019fcf20d

    • SHA512

      cc11219fa92b219d33cd111258fcbda65f02479d06b35c7589040fd9fafff0c842a50f690ad30046eb2e530cb5fbaca3b8ae1c7e23291aeaab4e9acafd5bdc82

    • SSDEEP

      768:F8TRp7qCDMI3IbV+qks5F9x+OZmDFBeTUjG1qEsbae4/evfI4yu/:2utIQ95FbCDFEUBR

    Score
    10/10
    asyncratratspywarestealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks