Overview

overview

10

Static

static

1

ac9b68f6b0...312.js

windows7-x64

3

ac9b68f6b0...312.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6bcf841be92d6f3dd70342ac47d7656.bin

  • Size

    1KB

  • Sample

    230324-cxw4nsdf9s

  • MD5

    2af2df145c69c19bee317226b1f6f295

  • SHA1

    b7d6339469a277e82078b073cb3de9e820af6812

  • SHA256

    6737ae8ed6a0d6b805471633b074a54e6d1282b74441a3bcc58cf3b953ecac09

  • SHA512

    a6c388f9f73563e0c8dbfc7668c9a49ec926e7645852e99c5a49ba60ba7be90c350d78fc65af800e0161bb6b093b9c8dee9ed0fed44f35328b2a67b64eb0fa35

Score
10/10
asyncratnewmekhapersistencerat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

newmekha

C2

pop11.linkpc.net:6606

pop11.linkpc.net:6666

pop11.linkpc.net:7707

pop11.linkpc.net:8808

198.244.206.24:6606

198.244.206.24:6666

198.244.206.24:7707

198.244.206.24:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ac9b68f6b0036e76adad58e6d1fd4c2d043e9ef53ac516ca38945bdfa3283312.js

    • Size

      92KB

    • MD5

      f6bcf841be92d6f3dd70342ac47d7656

    • SHA1

      8c45f916b43b3f689f290a3a340432d06c10e317

    • SHA256

      ac9b68f6b0036e76adad58e6d1fd4c2d043e9ef53ac516ca38945bdfa3283312

    • SHA512

      6e68532f29e5b8e8a874677f3fdefa1d3d600090dd369e113bcd849229b28ccbdccc0e2b092dc27f0491581c9db8b013f347319154cd906f333642a05337d215

    • SSDEEP

      1536:xkkkkkkkkkkk+kkkkkkkkkkk4Wkkkkkkkkkkkekkkkkkkkkkk6kkkkkkkkkkk56O:xkkkkkkkkkkk+kkkkkkkkkkkrkkkkkk0

    Score
    10/10
    asyncratnewmekhapersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Registers COM server for autorun

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

BITS Jobs

1
T1197

Privilege Escalation

Defense Evasion

BITS Jobs

1
T1197

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks