Overview

overview

10

Static

static

1

c90ba43060...77.exe

windows7-x64

10

c90ba43060...77.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c90ba430608e000e7b270f5b5157111ee4760fce3269084b5f2b46efd48cf577

  • Size

    1.9MB

  • Sample

    230424-zwzjqsee93

  • MD5

    171da24c24a495819291b45e99f2cb0e

  • SHA1

    6483d9c80da93eea0e84516e371c91336eaef681

  • SHA256

    48c368d7fdacb97f86acb10aee2115276ad56c7e8b470875f641cfdf0303a5fa

  • SHA512

    33779da0ecea8bfe19b7ec610b6297aed5e58e41ab367e54994d23a02d8ddb15d184a9535b4c20a0291f72252a60a60d8d4c8811ab37c0f5c84b85ec48961365

  • SSDEEP

    49152:qbIkVpX0sZ2XrYKSGsWm8JCdybPsaDGlI1f+ROJEnJoi36HNqbeqxq:xNqbJxq

Score
10/10
asyncratgamerat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Game

C2

84.54.50.51:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      c90ba430608e000e7b270f5b5157111ee4760fce3269084b5f2b46efd48cf577

    • Size

      1.9MB

    • MD5

      171da24c24a495819291b45e99f2cb0e

    • SHA1

      6483d9c80da93eea0e84516e371c91336eaef681

    • SHA256

      48c368d7fdacb97f86acb10aee2115276ad56c7e8b470875f641cfdf0303a5fa

    • SHA512

      33779da0ecea8bfe19b7ec610b6297aed5e58e41ab367e54994d23a02d8ddb15d184a9535b4c20a0291f72252a60a60d8d4c8811ab37c0f5c84b85ec48961365

    • SSDEEP

      49152:qbIkVpX0sZ2XrYKSGsWm8JCdybPsaDGlI1f+ROJEnJoi36HNqbeqxq:xNqbJxq

    Score
    10/10
    asyncratgamerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks