Overview

overview

10

Static

static

10

4308e51b0d...a9.exe

windows7-x64

10

4308e51b0d...a9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4308e51b0d81f385ad179af441ee1f3d0d4cbe6e42ab3e20299292316ff88fa9

  • Size

    11.2MB

  • Sample

    230329-bmdc5sfh5y

  • MD5

    e1c35e1be99e1398d24f67af4168a0ec

  • SHA1

    84c76d77a0efa5f8aa3594d194b44b5b3e0bcfdb

  • SHA256

    4308e51b0d81f385ad179af441ee1f3d0d4cbe6e42ab3e20299292316ff88fa9

  • SHA512

    f49a869848a687cdc12a155c0fb463106265f339ea72f5cabac7708cb076f2c43389a098df0e68cc0072039d80e8dbddc2116c842d879a4c718749405106a5df

  • SSDEEP

    196608:zBo77oOvM/lYe06PBSaqTLvgjn8Asdfc9Jsv6tWKFdu9CABMoVuCAsdf3Asdf:No77rGlYe06Z7eYsdE9Jsv6tWKFdu9Cs

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

tripdeep.duckdns.org:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      4308e51b0d81f385ad179af441ee1f3d0d4cbe6e42ab3e20299292316ff88fa9

    • Size

      11.2MB

    • MD5

      e1c35e1be99e1398d24f67af4168a0ec

    • SHA1

      84c76d77a0efa5f8aa3594d194b44b5b3e0bcfdb

    • SHA256

      4308e51b0d81f385ad179af441ee1f3d0d4cbe6e42ab3e20299292316ff88fa9

    • SHA512

      f49a869848a687cdc12a155c0fb463106265f339ea72f5cabac7708cb076f2c43389a098df0e68cc0072039d80e8dbddc2116c842d879a4c718749405106a5df

    • SSDEEP

      196608:zBo77oOvM/lYe06PBSaqTLvgjn8Asdfc9Jsv6tWKFdu9CABMoVuCAsdf3Asdf:No77rGlYe06Z7eYsdE9Jsv6tWKFdu9Cs

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks