Overview

overview

10

Static

static

10

9bbd2c016e...dc.exe

windows7-x64

10

9bbd2c016e...dc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3693114744003b6641e3c767518e47da.bin

  • Size

    23KB

  • Sample

    230331-blympahd9s

  • MD5

    b634d0eb7dbc7e8bdc7a32f39633e146

  • SHA1

    3643b5fda2a932bb5a2a42e41341648d63b8e3b7

  • SHA256

    55a6dff872fcf085ac8d89d4b09424431dc57872c307f47707c33955ee2997de

  • SHA512

    306b6a918b94d4566c9c2422d220c14bc37b60e7e578a0978f680fe9880a8df32fe9cc531afe62f813acafc170fb16f69532a049addf7610a79b036e45e62f88

  • SSDEEP

    384:ie0/xqB7yFoDF02S/Y15R2M6EIjb7++bTEEFikmdtl6rcSmE6H85va:i1/xWVR//cM6EK7+yPFRWtok85va

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

Botnet

Default

C2

seznam.zapto.org:6606

seznam.zapto.org:7707

seznam.zapto.org:8808

milla11.publicvm.com:6606

milla11.publicvm.com:7707

milla11.publicvm.com:8808
Mutex

trffisyuiifgqcpeof

Attributes
  • delay

    5

  • install

    true

  • install_file

    explorere.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc.exe

    • Size

      47KB

    • MD5

      3693114744003b6641e3c767518e47da

    • SHA1

      22df3884394cedffe035dfd1e73d2969468ec793

    • SHA256

      9bbd2c016eefb9e2edab3e8202e8a848bebac36f1565b596c54a0c3278a182dc

    • SHA512

      eb278143a1fa490d497d9869b50697a51d562504d0ee50f45a0fcb95654bc2a1b4534757ec7e3f8edd8a92742ef3855d91e5318b64cc0fb1b925f9d07d268836

    • SSDEEP

      768:0oFKMJMj5I4G3y/NlIR2qeYhQjCY7jbzgr3irE5a4g1fVMjrClZZ2tYcFmVc6K:0oFKMJezqzhMvbsrSX38urZKmVcl

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks