Overview

overview

10

Static

static

3

Phoenix VI...ax.exe

windows7-x64

10

Phoenix VI...ax.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Phoenix VIP Cod Hax.exe

  • Size

    53.8MB

  • Sample

    240404-vnzgjsdh62

  • MD5

    c234070617bf155bc3d878d3451c9959

  • SHA1

    5f7e63ce4964ec55b738cca144fe4e5ca9e6750e

  • SHA256

    804dd3b056b8de56517abdbd892105fbd96980ec2bad577a27599985826a7234

  • SHA512

    8830d47582218bd28344c4357bd9e446335f81aefbff3b50b10b48929c0f0923d585723fb003b5bbda90b72b8e2c57dd5a6adca9d6f5f2fa47568d93299aab62

  • SSDEEP

    786432:uOc/dCQiX7xY+sPLQUl6KlKrD9VCukim5RMxpADSEe9zuELfYWIlaxjC/hVXraOo:ufALszjlKv3kuvATiCELAUxmhtaOTs

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

mcehonline-48303.portmap.io:48303

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    true

  • install_file

    SearchIndexer.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Phoenix VIP Cod Hax.exe

    • Size

      53.8MB

    • MD5

      c234070617bf155bc3d878d3451c9959

    • SHA1

      5f7e63ce4964ec55b738cca144fe4e5ca9e6750e

    • SHA256

      804dd3b056b8de56517abdbd892105fbd96980ec2bad577a27599985826a7234

    • SHA512

      8830d47582218bd28344c4357bd9e446335f81aefbff3b50b10b48929c0f0923d585723fb003b5bbda90b72b8e2c57dd5a6adca9d6f5f2fa47568d93299aab62

    • SSDEEP

      786432:uOc/dCQiX7xY+sPLQUl6KlKrD9VCukim5RMxpADSEe9zuELfYWIlaxjC/hVXraOo:ufALszjlKv3kuvATiCELAUxmhtaOTs

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks