Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7

  • Size

    591KB

  • Sample

    230218-17vkladg35

  • MD5

    401240d7a40901b74d85ac7620b83915

  • SHA1

    3f512a8ff2f7d143a14badbc6191c3b8e09d23f6

  • SHA256

    d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7

  • SHA512

    996da140a45b98cfd0e8f803037296b1b73cb01793c6302784d2bd1ae6fb3a58b17f171e6eefd406b73637457031fb1363ff9c2f97ca6eaeb71a51c1bd0f5cd2

  • SSDEEP

    12288:Yr8m6f8WlGdAGUow9aR9IlzTmKa188LY1dPijURkY6z7ZIahRZ5GcrO:bIeG5IHgoiqjqZIS5GcrO

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

100.42.65.218:8080

100.42.65.218:6606
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    winsyd.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7

    • Size

      591KB

    • MD5

      401240d7a40901b74d85ac7620b83915

    • SHA1

      3f512a8ff2f7d143a14badbc6191c3b8e09d23f6

    • SHA256

      d1d057a3ef58e9d59c66346c27b1a9905fc6a90d28cefc69d46ae8fbdf7954e7

    • SHA512

      996da140a45b98cfd0e8f803037296b1b73cb01793c6302784d2bd1ae6fb3a58b17f171e6eefd406b73637457031fb1363ff9c2f97ca6eaeb71a51c1bd0f5cd2

    • SSDEEP

      12288:Yr8m6f8WlGdAGUow9aR9IlzTmKa188LY1dPijURkY6z7ZIahRZ5GcrO:bIeG5IHgoiqjqZIS5GcrO

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks