Overview

overview

10

Static

static

10

9BBD2C016E...5B.exe

windows7-x64

10

9BBD2C016E...5B.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe

  • Size

    47KB

  • Sample

    230329-z7bbaahh98

  • MD5

    3693114744003b6641e3c767518e47da

  • SHA1

    22df3884394cedffe035dfd1e73d2969468ec793

  • SHA256

    9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc

  • SHA512

    eb278143a1fa490d497d9869b50697a51d562504d0ee50f45a0fcb95654bc2a1b4534757ec7e3f8edd8a92742ef3855d91e5318b64cc0fb1b925f9d07d268836

  • SSDEEP

    768:0oFKMJMj5I4G3y/NlIR2qeYhQjCY7jbzgr3irE5a4g1fVMjrClZZ2tYcFmVc6K:0oFKMJezqzhMvbsrSX38urZKmVcl

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

Botnet

Default

C2

seznam.zapto.org:6606

seznam.zapto.org:7707

seznam.zapto.org:8808

milla11.publicvm.com:6606

milla11.publicvm.com:7707

milla11.publicvm.com:8808
Mutex

trffisyuiifgqcpeof

Attributes
  • delay

    5

  • install

    true

  • install_file

    explorere.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      9BBD2C016EEFB9E2EDAB3E8202E8A848BEBAC36F1565B.exe

    • Size

      47KB

    • MD5

      3693114744003b6641e3c767518e47da

    • SHA1

      22df3884394cedffe035dfd1e73d2969468ec793

    • SHA256

      9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc

    • SHA512

      eb278143a1fa490d497d9869b50697a51d562504d0ee50f45a0fcb95654bc2a1b4534757ec7e3f8edd8a92742ef3855d91e5318b64cc0fb1b925f9d07d268836

    • SSDEEP

      768:0oFKMJMj5I4G3y/NlIR2qeYhQjCY7jbzgr3irE5a4g1fVMjrClZZ2tYcFmVc6K:0oFKMJezqzhMvbsrSX38urZKmVcl

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks