Analysis
-
max time kernel
147s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
-
submitted
24/12/2023, 02:05 UTC
General
-
Target
b47c77d237243747a51dd02d836444ba067cf6cc4b8b3344e5cf791f5f41d20e.exe
-
Size
20.7MB
-
MD5
ddab2fe165c9c02281780f38f04a614e
-
SHA1
2a5ad37e94037a4fc39ce7ba2d66ed8a424383e4
-
SHA256
b47c77d237243747a51dd02d836444ba067cf6cc4b8b3344e5cf791f5f41d20e
-
SHA512
2ed2fae0cf40365710b237def0762c2afe5f7a7ee67d7a5ebcf2edf35e65dcfa761bf9a8557fa4fbe57f17a54043f700e7131fb170afdba37bc255d163f6b74f
-
SSDEEP
393216:STs66TCP+Zw6NLIsFfskh1BmXGN1Bd++ufV:Es66TCP+Zlnk0rmYBYF
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
BoratRAT 3 IoCs
BoratRAT is an all-in-one malware toolkit that is capable of a variety of destructive activities, including acting as a ransomware, and performing credential theft.
-
Async RAT payload 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b47c77d237243747a51dd02d836444ba067cf6cc4b8b3344e5cf791f5f41d20e.exe"C:\Users\Admin\AppData\Local\Temp\b47c77d237243747a51dd02d836444ba067cf6cc4b8b3344e5cf791f5f41d20e.exe"1⤵
Network
-
DNS178.223.142.52.in-addr.arpaRemote address:8.8.8.8:53Request178.223.142.52.in-addr.arpaIN PTRResponse -
DNS114.110.16.96.in-addr.arpaRemote address:8.8.8.8:53Request114.110.16.96.in-addr.arpaIN PTRResponse114.110.16.96.in-addr.arpaIN PTRa96-16-110-114deploystaticakamaitechnologiescom
-
DNS13.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
DNS5.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request5.173.189.20.in-addr.arpaIN PTRResponse
-
DNS180.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
No results found
-
8.8.8.8:53178.223.142.52.in-addr.arpadns
DNS Request
178.223.142.52.in-addr.arpa
-
8.8.8.8:53114.110.16.96.in-addr.arpadns
DNS Request
114.110.16.96.in-addr.arpa
-
8.8.8.8:5313.227.111.52.in-addr.arpadns
DNS Request
13.227.111.52.in-addr.arpa
-
8.8.8.8:53180.178.17.96.in-addr.arpadns
DNS Request
180.178.17.96.in-addr.arpa
-
8.8.8.8:535.173.189.20.in-addr.arpadns
DNS Request
5.173.189.20.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.6MB
-
Filesize
4KB
-
Filesize
20.4MB
-
Filesize
6.9MB
-
Filesize
5.0MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
20.6MB
-
Filesize
6.9MB
-
Filesize
64KB