Overview

overview

10

Static

static

1

4959354bc8...JC.ps1

windows7-x64

1

4959354bc8...JC.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80_JC.unknown

  • Size

    430KB

  • Sample

    231011-ngyhcabe3w

  • MD5

    3522c1f7f4328df9bcd67cf7aad28eae

  • SHA1

    4b91582c6fc365877b23dce2b3a7782dd3dd057f

  • SHA256

    4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80

  • SHA512

    c3f466a4435b0d89fe72b913e422347a855f8179b95a8fd4dafde8108a6eac7d7c52404076342cc876e82ca83885a0dadbceb4d9fcb9c4a99f7dd30b2c960d18

  • SSDEEP

    3072:w4xxUF6xj08315d3Apo4ypzUeE6Ue+VM8fpBTUv1vZuWQIG7Dl8a:w4xxeQj08315d3Apo0VNRBRWQIM

Score
10/10
asyncratjokerrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

joker

C2

45.138.16.87:998

lol1112s.sells-it.net:998

l11ol12s.sells-it.net:998
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80_JC.unknown

    • Size

      430KB

    • MD5

      3522c1f7f4328df9bcd67cf7aad28eae

    • SHA1

      4b91582c6fc365877b23dce2b3a7782dd3dd057f

    • SHA256

      4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80

    • SHA512

      c3f466a4435b0d89fe72b913e422347a855f8179b95a8fd4dafde8108a6eac7d7c52404076342cc876e82ca83885a0dadbceb4d9fcb9c4a99f7dd30b2c960d18

    • SSDEEP

      3072:w4xxUF6xj08315d3Apo4ypzUeE6Ue+VM8fpBTUv1vZuWQIG7Dl8a:w4xxeQj08315d3Apo0VNRBRWQIM

    Score
    10/10
    asyncratjokerrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks