Overview

overview

10

Static

static

1f349eb4f2...a4.exe

windows7-x64

10

1f349eb4f2...a4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1f349eb4f2907662b86d1f94cea26d2857e8728ef13228cd7cf48c367ba118a4

  • Size

    507KB

  • Sample

    230129-1xcl2aee28

  • MD5

    d8851e861c60745223c8545d327e7c02

  • SHA1

    68a2772a8750ac4ce84b206c6a79502a4864743a

  • SHA256

    1f349eb4f2907662b86d1f94cea26d2857e8728ef13228cd7cf48c367ba118a4

  • SHA512

    528b54ecacc6f7b01a47d0404b960dfd0d3270131ef0744c067126714052c3e05d7e9d9ee377e72e333822a8d3b76634ef6f33f5d8882d6aced483b88d3a0520

  • SSDEEP

    12288:5hqxSLo5C1Ps4XhitX+t498qkgj4SRW+ftfeGF034r+:5HLmCiIhiX6A4S9ft2BIr+

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

v13cracker.ddns.net:6606

Mutex

&&pLO91K^RG#!P72IIrjkU^kv9qPNuvKBnGN5#l8^5a9kN9jA9

Attributes
  • delay

    3

  • install

    false

  • install_file

    system.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      1f349eb4f2907662b86d1f94cea26d2857e8728ef13228cd7cf48c367ba118a4

    • Size

      507KB

    • MD5

      d8851e861c60745223c8545d327e7c02

    • SHA1

      68a2772a8750ac4ce84b206c6a79502a4864743a

    • SHA256

      1f349eb4f2907662b86d1f94cea26d2857e8728ef13228cd7cf48c367ba118a4

    • SHA512

      528b54ecacc6f7b01a47d0404b960dfd0d3270131ef0744c067126714052c3e05d7e9d9ee377e72e333822a8d3b76634ef6f33f5d8882d6aced483b88d3a0520

    • SSDEEP

      12288:5hqxSLo5C1Ps4XhitX+t498qkgj4SRW+ftfeGF034r+:5HLmCiIhiX6A4S9ft2BIr+

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks