Overview

overview

10

Static

static

5629471239...38.exe

windows7-x64

10

5629471239...38.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5629471239d4e9ef5585ea8ee2707cb6d029a62f834e02d2110657bc30842638

  • Size

    52KB

  • Sample

    230131-wmml2ahe32

  • MD5

    ccb79a11b34abd4761e9f7cb1dc003cc

  • SHA1

    6635a57939a75688c4878a9cad42c48d50176a50

  • SHA256

    d5ae5e58196fd6b4e25e5f1cf734ffc1c0e7f77b9165c5d389830ace5ee9d913

  • SHA512

    e1608f3cc480af6ed7d9863d11e19eb03a1bdd4b7776caf73cf65f4ac7fde2e1ed54ed69949b8591ffb9f32baea6d2c6adc0beb01a199ba9dad9c520a1347912

  • SSDEEP

    768:B2nROY80s5svEPIFURXS8r/WGhjJPNa1ewEgPCNYktMqulj+PJHNFC8hSrU2rgc5:B2v83+QTnhjJPE1ehgKyktMc3zSLrt3J

Score
10/10
asyncratsecurityhealthservicepersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

SecurityHealthService

C2

20.4.6.16:43521

Mutex

SecurityHealthService

Attributes
  • delay

    3

  • install

    false

  • install_file

    SecurityHealthService

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      5629471239d4e9ef5585ea8ee2707cb6d029a62f834e02d2110657bc30842638

    • Size

      68KB

    • MD5

      b2039684208ca1a2c62b998de4c60917

    • SHA1

      8c287a28c0aa74ccfa239d9af9611a3be1f39467

    • SHA256

      5629471239d4e9ef5585ea8ee2707cb6d029a62f834e02d2110657bc30842638

    • SHA512

      7f73b48457f3e0428b9c19228141521a6b867e15741822094701d967da9e783ff69f6b56fc808cb15e33fa1789796c4ff0f3ed719faf4a25becda5e831a41d55

    • SSDEEP

      1536:/noX9rFpQf4zr32weL52hRnUTaitZzJI7bFBo2:fKRO4zrmJL5sRUTftZ9I7no2

    Score
    10/10
    asyncratsecurityhealthservicepersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks