Overview

overview

10

Static

static

119996da24...28.exe

windows7-x64

10

119996da24...28.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    119996da24b3935ec811bcd72583b6d1cd5205097265100c20a6ce773b79fb28

  • Size

    181KB

  • Sample

    230129-zblr5scc44

  • MD5

    35e7cba9da6186aabcbeb680b9e62a0f

  • SHA1

    a0aa491f942b485f15a7f59104e26beac1033591

  • SHA256

    119996da24b3935ec811bcd72583b6d1cd5205097265100c20a6ce773b79fb28

  • SHA512

    64d079e1c3315cd77a018c6b998a5e9a86b45f11565dc00f4f6da737808aab9f5075ba6e96eb915940232333d8706703c80844eb7d86d0585b066bef5c899e12

  • SSDEEP

    3072:CmwGb4OB7fOBUPH354yZqpQVGGRGyAiMeFNNiE7TE8pkkN2eJ1BMZbQX9nMs:CmlfB7zPpypQVGGR6IN3I8pky2kEg9n

Score
10/10
asyncratsystemrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

SYSTEM

C2

UtilityService.ignorelist.com:9696

UtilityService.ignorelist.com:1738

UtilityService.ignorelist.com:2269
Mutex

SGFSHJFgkjdsfadfurgGW

Attributes
  • delay

    3

  • install

    true

  • install_file

    Boot Utility Service.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      119996da24b3935ec811bcd72583b6d1cd5205097265100c20a6ce773b79fb28

    • Size

      181KB

    • MD5

      35e7cba9da6186aabcbeb680b9e62a0f

    • SHA1

      a0aa491f942b485f15a7f59104e26beac1033591

    • SHA256

      119996da24b3935ec811bcd72583b6d1cd5205097265100c20a6ce773b79fb28

    • SHA512

      64d079e1c3315cd77a018c6b998a5e9a86b45f11565dc00f4f6da737808aab9f5075ba6e96eb915940232333d8706703c80844eb7d86d0585b066bef5c899e12

    • SSDEEP

      3072:CmwGb4OB7fOBUPH354yZqpQVGGRGyAiMeFNNiE7TE8pkkN2eJ1BMZbQX9nMs:CmlfB7zPpypQVGGR6IN3I8pky2kEg9n

    Score
    10/10
    asyncratsystemrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Core1 .NET packer

      Detects packer/loader used by .NET malware.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks