Overview

overview

10

Static

static

10

1680-3-0x0...ry.exe

windows7-x64

10

1680-3-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1680-3-0x0000000000510000-0x0000000000522000-memory.dmp

  • Size

    72KB

  • Sample

    231206-vs48laff91

  • MD5

    0760ccf06513794ba0a457234bd63529

  • SHA1

    362a9b3eadf2746b7b63d4b1159107e15a08ef5d

  • SHA256

    a46c34060509e0bc0bafcda594ffadc4b236426cd94ca6950b2b4d10e9f29fed

  • SHA512

    d512fafb812d7b636e176a1ad438fe2a492455391dd785b0f2e7f1d0d32045c0111af74278c00dc4b4f2330d5cf3a58bdbded9dd6688bf6fd988987aee6ed2a6

  • SSDEEP

    768:Qov5MNNmnO4Gl2CN8wG8yU5CFbjbRgr3iEZ9PKAClZN2tYcFmVc6K:Qov5MNQDXUEPberSQWrNKmVcl

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6D

Botnet

Default

C2

seznam.zapto.org:6606

seznam.zapto.org:7707

seznam.zapto.org:8808

ronymahmoud.casacam.net:6606

ronymahmoud.casacam.net:7707

ronymahmoud.casacam.net:8808
Mutex

imhydkyywihv

Attributes
  • delay

    9

  • install

    true

  • install_file

    explorrare.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      1680-3-0x0000000000510000-0x0000000000522000-memory.dmp

    • Size

      72KB

    • MD5

      0760ccf06513794ba0a457234bd63529

    • SHA1

      362a9b3eadf2746b7b63d4b1159107e15a08ef5d

    • SHA256

      a46c34060509e0bc0bafcda594ffadc4b236426cd94ca6950b2b4d10e9f29fed

    • SHA512

      d512fafb812d7b636e176a1ad438fe2a492455391dd785b0f2e7f1d0d32045c0111af74278c00dc4b4f2330d5cf3a58bdbded9dd6688bf6fd988987aee6ed2a6

    • SSDEEP

      768:Qov5MNNmnO4Gl2CN8wG8yU5CFbjbRgr3iEZ9PKAClZN2tYcFmVc6K:Qov5MNQDXUEPberSQWrNKmVcl

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks