Overview

overview

10

Static

static

10

1dac278c05...76.exe

windows7-x64

10

1dac278c05...76.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a2fe740af2f9b1bcf6b4f05bc38c810.bin

  • Size

    23KB

  • Sample

    230212-bsrgyshd7v

  • MD5

    0ff5d80518c46c4b7454f73f2fe2d2b8

  • SHA1

    9a7470aada689dccec3050b32f0cf4a5b8905f86

  • SHA256

    9797431c1548f6720062e6d128ea506ce9efd18cd4e00b87e5b7a1877fb8d7ee

  • SHA512

    6df8f7af4fef5cecc330426dac5a4ca2eb2b6b08672faf765443955947559e3ae5a08fdb525ac9e4481e2c7f5d78b8675f328b6741d2dfd49f0df294361c0399

  • SSDEEP

    384:+kVtn/4p9xT4jW9l7nsfP2BxCDq3Xcv/DAXf1m+nzC8PvkYUOCB1PHwe8jSC3ddz:+yV/495/zgq3sv/0hC8nVUOCBRwZSCfT

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

135.181.204.51:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    true

  • install_file

    Desktop Window Manager.exe

  • install_folder

    %Temp%

aes.plain

Targets

    • Target

      1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476.exe

    • Size

      48KB

    • MD5

      6a2fe740af2f9b1bcf6b4f05bc38c810

    • SHA1

      17f247fb43800115495b4463f10355660e5d5b45

    • SHA256

      1dac278c05c70bc6df9e9eff71a38932549c61f51e1fed6239420a3c542c0476

    • SHA512

      12c428724eece2c7ae9b85fb5b5b95b5151ee9e0a0f5e8b3ab9739d6a7394e9f2374c03b0744c44d14cf10bc75c80f0e9c4e39587065d2db7e69a0286aa3c6ea

    • SSDEEP

      768:mUkPIL2C6y+DiNbik7U8Yb2g1WyCXvEgK/JSTJVc6KN:mU22UzbpAyCXnkJqJVclN

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks