Overview

overview

10

Static

static

3

svchost.exe

windows7-x64

10

svchost.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost.exe

  • Size

    4.9MB

  • Sample

    230520-sx2l6adb27

  • MD5

    6a6d722b4d27203afa3c468ddc6b96b0

  • SHA1

    de9c73b7f98ed83dd17903ef41021481e30ef369

  • SHA256

    ddd4f8f5f13ada5e5b4bc3d0b0d1a49572b68f600ef3bda720566171f229c5c6

  • SHA512

    2418cdd6cf0b8e561847094a82235c83e0a146a2cbe53160f659e4a06192b51a6b7b90bf853a7901e879fc6e833928c4d061bf660e684c73d8ed8465ea1e16ab

  • SSDEEP

    49152:jc+tbK8sTWJ708s2iwe0bjIZaxzrzrx8l0n3JjpmdPvoM/ICr5TVD:Y+1KbTWJY8saPbjICzPrGYFpmdPg8V

Score
10/10
asyncratmicrosoftrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Microsoft

C2

megaplaneta01.ddns.net:4782

localhost:4782
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      svchost.exe

    • Size

      4.9MB

    • MD5

      6a6d722b4d27203afa3c468ddc6b96b0

    • SHA1

      de9c73b7f98ed83dd17903ef41021481e30ef369

    • SHA256

      ddd4f8f5f13ada5e5b4bc3d0b0d1a49572b68f600ef3bda720566171f229c5c6

    • SHA512

      2418cdd6cf0b8e561847094a82235c83e0a146a2cbe53160f659e4a06192b51a6b7b90bf853a7901e879fc6e833928c4d061bf660e684c73d8ed8465ea1e16ab

    • SSDEEP

      49152:jc+tbK8sTWJ708s2iwe0bjIZaxzrzrx8l0n3JjpmdPvoM/ICr5TVD:Y+1KbTWJY8saPbjICzPrGYFpmdPg8V

    Score
    10/10
    asyncratmicrosoftrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks