Overview

overview

10

Static

static

1

cf1de08c2a...e7.exe

windows7-x64

10

cf1de08c2a...e7.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7

  • Size

    1.8MB

  • Sample

    230211-yjw3eafg9s

  • MD5

    4fae4e3df84f89f77df25ed6e9674940

  • SHA1

    720372d130c4931506ed0df1ede36dada6803f72

  • SHA256

    cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7

  • SHA512

    08161380459a529918a94acb6acf9d149ba1e4de0a78f90c4db32cabb54a24114d1902da57dbbe49750e61607af667c8ff851201caf42cde83f2391bca6d2c2a

  • SSDEEP

    49152:diszHX1u6cLxfOEPZldmn0TAI5FWQzt+1wBcv+lRA6ZtrPt9gsjGvlaQz:EszHXM6c1dmsAIiQzt+1wmv+lRAorPLq

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    43.155.145.155
  • Port:
    21
  • Username:
    123
  • Password:
    123

Extracted

Family

asyncrat

Version

Gh0st RAT

Botnet

Default

C2

43.249.30.55:8848

Mutex

DcRatMutex

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7

    • Size

      1.8MB

    • MD5

      4fae4e3df84f89f77df25ed6e9674940

    • SHA1

      720372d130c4931506ed0df1ede36dada6803f72

    • SHA256

      cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7

    • SHA512

      08161380459a529918a94acb6acf9d149ba1e4de0a78f90c4db32cabb54a24114d1902da57dbbe49750e61607af667c8ff851201caf42cde83f2391bca6d2c2a

    • SSDEEP

      49152:diszHX1u6cLxfOEPZldmn0TAI5FWQzt+1wBcv+lRA6ZtrPt9gsjGvlaQz:EszHXM6c1dmsAIiQzt+1wmv+lRAorPLq

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks