Overview

overview

10

Static

static

10

Infected.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Infected.exe

  • Size

    63KB

  • Sample

    240501-tb8n1scg24

  • MD5

    ad7b88bdcbeb87873c4fa8c164fd91bb

  • SHA1

    4a248ffe2f4bd1d9570421f1aa892f9b2c69b0bf

  • SHA256

    6a307f1adf1b502d218dca101b9c9731fb44ffda5a4a2eb0de5c5120b380386b

  • SHA512

    2e7904e3a40be399af2d883c1a2982a23c67990597a77df83dfe1fd8dd05e5de918cb6573bbdb3261131f8b88163c82763d72758b644399d1e894426c1417c0e

  • SSDEEP

    768:jnuguX1wbgyX78dIC8A+XkuazcBRL5JTk1+T4KSBGHmDbD/ph0oXN3p7JZuwSuEV:rvCCPTDdSJYUbdh9pp7JsuEdpqKmY7

Score
10/10
asyncratstealeriumdefaultcollectionratspywarestealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

193.161.193.99:50291

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Infected.exe

    • Size

      63KB

    • MD5

      ad7b88bdcbeb87873c4fa8c164fd91bb

    • SHA1

      4a248ffe2f4bd1d9570421f1aa892f9b2c69b0bf

    • SHA256

      6a307f1adf1b502d218dca101b9c9731fb44ffda5a4a2eb0de5c5120b380386b

    • SHA512

      2e7904e3a40be399af2d883c1a2982a23c67990597a77df83dfe1fd8dd05e5de918cb6573bbdb3261131f8b88163c82763d72758b644399d1e894426c1417c0e

    • SSDEEP

      768:jnuguX1wbgyX78dIC8A+XkuazcBRL5JTk1+T4KSBGHmDbD/ph0oXN3p7JZuwSuEV:rvCCPTDdSJYUbdh9pp7JsuEdpqKmY7

    Score
    10/10
    asyncratstealeriumdefaultcollectionratspywarestealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

      stealerstealerium

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks