Overview

overview

10

Static

static

1

J.ps1

windows7-x64

1

J.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    J.png

  • Size

    571KB

  • Sample

    230402-zdl6paae34

  • MD5

    cfa306c7cae61b3ffef8c6af0c521bf1

  • SHA1

    6269028daacb6ae8bf6b78b1d076fa0abf606939

  • SHA256

    4152aa9073b4490e5e07590c816e5bea59285e51649f3dc1a6f001bb2045ea9f

  • SHA512

    645787302c16ade46a08ab5cbd7761e85870d964c991f1c01109b0e89f220c6aba03082a2b910857a0ab3e605f8ece4f1d21d5789d78acb83ba17f31d85c060b

  • SSDEEP

    1536:M+fNYbUBC9rBWPSPmtPtSh/FWUHUQ7ql0GldT897z3MlXHX62nkJWz9vfhaZffcT:Bo74Pdw32lk0VhEeAq17d3

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

xxxpasoxxx.ddnsfree.com:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      J.png

    • Size

      571KB

    • MD5

      cfa306c7cae61b3ffef8c6af0c521bf1

    • SHA1

      6269028daacb6ae8bf6b78b1d076fa0abf606939

    • SHA256

      4152aa9073b4490e5e07590c816e5bea59285e51649f3dc1a6f001bb2045ea9f

    • SHA512

      645787302c16ade46a08ab5cbd7761e85870d964c991f1c01109b0e89f220c6aba03082a2b910857a0ab3e605f8ece4f1d21d5789d78acb83ba17f31d85c060b

    • SSDEEP

      1536:M+fNYbUBC9rBWPSPmtPtSh/FWUHUQ7ql0GldT897z3MlXHX62nkJWz9vfhaZffcT:Bo74Pdw32lk0VhEeAq17d3

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks