Overview

overview

10

Static

static

10

7f92d176bc...d7.exe

windows7-x64

10

7f92d176bc...d7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7f92d176bc63d7be85b3a37cc32069d7.bin

  • Size

    633KB

  • Sample

    231014-cyrwcabh8t

  • MD5

    7f92d176bc63d7be85b3a37cc32069d7

  • SHA1

    2bad07d0470f25bf6db1e83c2b9ac521060bd5eb

  • SHA256

    1309be5f741e8219d52677f0861be0c9168628b303c912d37bb32ff62ea7db4d

  • SHA512

    28efae533df7af95dbbbcadcaa35bcc22362cf8160025db798bfb7c8539e5dd8046236bd727931b46e7787c2e49e7943a3d062fadf150652c7acad5bbe17b712

  • SSDEEP

    768:ULdNILaiWW+ri1telDSN+iV08YbygePrFzpxUUmNvEgK/J7ZVc6KN:ULV61tKDs4zb14FVxfmnkJ7ZVclN

Score
10/10
asyncratdiscordrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Discord

C2

tr2.localto.net:44728

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    true

  • install_file

    taskhostt.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      7f92d176bc63d7be85b3a37cc32069d7.bin

    • Size

      633KB

    • MD5

      7f92d176bc63d7be85b3a37cc32069d7

    • SHA1

      2bad07d0470f25bf6db1e83c2b9ac521060bd5eb

    • SHA256

      1309be5f741e8219d52677f0861be0c9168628b303c912d37bb32ff62ea7db4d

    • SHA512

      28efae533df7af95dbbbcadcaa35bcc22362cf8160025db798bfb7c8539e5dd8046236bd727931b46e7787c2e49e7943a3d062fadf150652c7acad5bbe17b712

    • SSDEEP

      768:ULdNILaiWW+ri1telDSN+iV08YbygePrFzpxUUmNvEgK/J7ZVc6KN:ULV61tKDs4zb14FVxfmnkJ7ZVclN

    Score
    10/10
    asyncratdiscordrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks