Overview

overview

10

Static

static

10

3702de50af...39.exe

windows7-x64

10

3702de50af...39.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15812c269dcb051b5b23a540696d5288.bin

  • Size

    23KB

  • Sample

    230410-bgnlxsga9s

  • MD5

    ea750f82a1b156c1d0fa659f5fa7c1c5

  • SHA1

    f2dbd1f217cbb88f4582c9430f25ac17931ef4f1

  • SHA256

    2c117f6798100a4d18bed064679120c94c18915e9bdcf627db60c030857fee55

  • SHA512

    e1b865e0d231a83e7f071c8af704f9d4fe7b2a72cc4bb4ab2f3d8c0aa0ff041b96aff15b33f3b9ced562c813fa771daaf1eab3dbfb46774a949f3fac49c63f94

  • SSDEEP

    384:EcvPHuWgkCLzWZcTN+tFsMNFBZ//O4+mbNjQlVUGYVB4ONNMfdEFMr:EyWYCLzWZ/Pe4rByV6OwNMfdl

Score
10/10
asyncratsystemrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

System

C2

147.185.221.180:1491

Mutex

llfesnjkqacrdhbtbu

Attributes
  • delay

    1

  • install

    true

  • install_file

    THASUPREMETROJAN.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      3702de50af26c3d4288bb4c9c4bde0f0bb0cd98873393b4e38394c6848fad039.exe

    • Size

      47KB

    • MD5

      15812c269dcb051b5b23a540696d5288

    • SHA1

      db261e59e91e57ec14f45798bde865c01482ec15

    • SHA256

      3702de50af26c3d4288bb4c9c4bde0f0bb0cd98873393b4e38394c6848fad039

    • SHA512

      059a96840dc099edd5a859668a531068cb45f37dbe00a2a00233b1b581a35fa5cb17c44631dc01e7588370de230b8733a9934bbfb115d159417c72efba6346ba

    • SSDEEP

      768:xOduRtILkWAA+jiFtelDSN+iV08YbygeiCPdYPy22pvEgK/JLZVc6KN:8duNoFtKDs4zb1omJ2pnkJLZVclN

    Score
    10/10
    asyncratsystemrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks