Overview

overview

10

Static

static

10

107412ff8d...65.exe

windows7-x64

10

107412ff8d...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    107412ff8d9ab42fd1944db79d22b365.exe

  • Size

    48KB

  • Sample

    230211-llhatadc7v

  • MD5

    107412ff8d9ab42fd1944db79d22b365

  • SHA1

    02f88a1a858d34aac3ebc58b1bea5b85d70c5fc6

  • SHA256

    5974ab14aa9e0a1adf11517f431a0fe46316fe37b70b91eb47dc219034ce7437

  • SHA512

    c740ee81535e2488d36f2fe2413a7995d2cbb35c08e486b70907994c002f1a15aabeb3b57646b3bfc667e950ef1616dd18edb4a775e09b213b071bb93b996524

  • SSDEEP

    768:9eICljTILmCKi+DiBtelDSN+iV08Ybygeze1Acl5yMTvEgK/JP5Vc6KN:9eIYdmBtKDs4zb1Wcls0nkJP5VclN

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

loader2b.duckdns.org:57913

Mutex

352y7t89soydgjsilhgb7805guiao

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      107412ff8d9ab42fd1944db79d22b365.exe

    • Size

      48KB

    • MD5

      107412ff8d9ab42fd1944db79d22b365

    • SHA1

      02f88a1a858d34aac3ebc58b1bea5b85d70c5fc6

    • SHA256

      5974ab14aa9e0a1adf11517f431a0fe46316fe37b70b91eb47dc219034ce7437

    • SHA512

      c740ee81535e2488d36f2fe2413a7995d2cbb35c08e486b70907994c002f1a15aabeb3b57646b3bfc667e950ef1616dd18edb4a775e09b213b071bb93b996524

    • SSDEEP

      768:9eICljTILmCKi+DiBtelDSN+iV08Ybygeze1Acl5yMTvEgK/JP5Vc6KN:9eIYdmBtKDs4zb1Wcls0nkJP5VclN

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks