Overview

overview

10

Static

static

10

TPSPoxR1tj...17.zip

windows11-21h2-x64

1

Defender_Settings.vbs

windows11-21h2-x64

1

VantaFN.exe

windows11-21h2-x64

10

dControl.exe

windows11-21h2-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17.zip

  • Size

    483KB

  • MD5

    194c188093dcc132a8deea7b0dad1f2c

  • SHA1

    d52b99d85b91aa1fbdfe4afbb25d099539108380

  • SHA256

    83d1269b87125006ff08fd7d99a1e5b1fd62e9769848d9912853f4e56cb6ebff

  • SHA512

    dbb761c7e3210103ffd9aa1bf3c95eec5dcb47bcb8532635c3d4ebe5e0ca40e0f4e5e53cad880f5253b4009ef4bdc162be2c0545a95692beaef2840aa522c220

  • SSDEEP

    12288:FFT5Lc95Y6ynYHofdfppn4UJctToWkzGnp:FWPynYIfdxmU6cGp

Score
10/10
ratdefaultupxasyncrat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/z5PQ82wE

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17.zip
    .zip
  • Defender_Settings.vbs
    .vbs
  • ReadMe.txt
  • VantaFN.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • dControl.exe
    .exe windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • dControl.ini