Overview

overview

10

Static

static

10

app_any_ru...it.ps1

windows7-x64

1

app_any_ru...it.ps1

windows10-2004-x64

8

4eb22bcde9...16.exe

windows7-x64

10

4eb22bcde9...16.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    app_any_run.rar.zip

  • Size

    27KB

  • MD5

    386ad453dc5b01767162fd8f7e7f6e43

  • SHA1

    e507bf2997ee7edae9b7cdd73b9d052439bc0fd5

  • SHA256

    85af734ab098de6d1b39f076ef4db5b0c1cb80fee43a41026ea16bff0be5ad34

  • SHA512

    221aa728779d26ecfee3b09c1a17789418bdbcaa4fcad173a9ee6d718f3fae6ee69feee875ad5d19308d1232b490369fc1037a888b4e6e993f060d81f9a88599

  • SSDEEP

    384:2lVSVwrtCKbob91wGVC5h5wwuf0/q120veUj+oWb5YNGSLBelYJxT:2rPvbE91bVC/5wwuQZ03jC5YNGAel4

Score
10/10
ratdominios 777asyncrat

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://live.sysinternals.com/Sysmon.exe
exe.dropper

https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig-with-filedelete.xml

Extracted

Family

asyncrat

Version

1.0.7

Botnet

DOMINIOS 777

C2

liverpool777.duckdns.org:7094

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • app_any_run.rar.zip
    .zip

    Password: infected

  • app_any_run.rar
    .rar .zip polyglot

    Password: infected

  • app_any_run_conf_audit.ps1
    .ps1
  • malware.zip
    .zip

    Password: infected

  • 4eb22bcde9c1f6978506647ab39e9e4245cb4bde3a359c0348e37ec3f9c12116
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections