Overview

overview

10

Static

static

ecce569ab3...80.exe

windows7-x64

10

ecce569ab3...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ecce569ab37bb81362c33374e867303b5927689ad15a54a88e6013a3b85c1d80

  • Size

    507KB

  • Sample

    230129-1xb1haee27

  • MD5

    dcbd5c74983063308220a5fe8426dad7

  • SHA1

    6bcb87b9c97ae777c35ba6f0c3171bc056935714

  • SHA256

    ecce569ab37bb81362c33374e867303b5927689ad15a54a88e6013a3b85c1d80

  • SHA512

    238d3c4978707dbd5060c18c8b83b91c1aa9e4649430a3116570265e89b7bd0f5ebbe2820267c4e78bf726b48398b0175a44bba6d3b28d73e6689768b1d90d79

  • SSDEEP

    12288:5hqxSLo5C1Ps4XhitX+t498svkg44SDxSECrtIf0:5HLmCiIhiXzkg44SDMECrKM

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

v13cracker.ddns.net:6606

Mutex

&&pLO91K^RG#!P72IIrjkU^kv9qPNuvKBnGN5#l8^5a9kN9jA9

Attributes
  • delay

    3

  • install

    false

  • install_file

    system.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ecce569ab37bb81362c33374e867303b5927689ad15a54a88e6013a3b85c1d80

    • Size

      507KB

    • MD5

      dcbd5c74983063308220a5fe8426dad7

    • SHA1

      6bcb87b9c97ae777c35ba6f0c3171bc056935714

    • SHA256

      ecce569ab37bb81362c33374e867303b5927689ad15a54a88e6013a3b85c1d80

    • SHA512

      238d3c4978707dbd5060c18c8b83b91c1aa9e4649430a3116570265e89b7bd0f5ebbe2820267c4e78bf726b48398b0175a44bba6d3b28d73e6689768b1d90d79

    • SSDEEP

      12288:5hqxSLo5C1Ps4XhitX+t498svkg44SDxSECrtIf0:5HLmCiIhiXzkg44SDMECrKM

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks