Overview

overview

10

Static

static

10

Byte Usern...er.exe

windows7-x64

10

Byte Usern...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    58721ab5987ae84c158e21e72c871433_JaffaCakes118

  • Size

    333KB

  • Sample

    240519-ekbnbahe66

  • MD5

    58721ab5987ae84c158e21e72c871433

  • SHA1

    3f52cd14783785643291f2dcbae72dce3b1de2ec

  • SHA256

    a2858616779ffd82b7ca8897429270ea737990e882f0c165c75e9cd8a9fc0ae8

  • SHA512

    8513ed077f142673716be031b7011f75c3629a5f2f966614e5a647ed475befc0eeb2174f4c8db459a8a9838bbde89ba5e33ade0d54d5922b962380ea621df9f5

  • SSDEEP

    6144:Zvqa1A8jchgUpL86NfDu/kg3fGSb/jbD3oN6hd4i+ef1XQxQtU:Nj1LjIpfZu1TLv4whdzQqtU

Score
10/10
asyncratrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

C2

3.17.177.175:1337

Mutex

etzgrlmsnolisgbioe

Attributes
  • delay

    5

  • install

    true

  • install_file

    updater.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Byte Username Checker.exe

    • Size

      392KB

    • MD5

      a61034d8a54f5ae3c5ca31f2a9efea9e

    • SHA1

      05ae35a5dd8483e205af45e2e92d3884cd167281

    • SHA256

      e001cdb30543127e5a86b90645e14b0d43ae319a5b872a270177642d24b2fc0b

    • SHA512

      ec8e80fc985005274704dffdc8a12c389459511f0783f614e1f83de52592706ec47d98462af21c3bf848c86f8b875c718adea56659628b300a8a64c6f2680ca1

    • SSDEEP

      6144:tHV6bX8UA8BcJgUpL8SNFDu/O63hGSb/DB5pr0+UTsWkef1XwxQ1nId:t1BULB+p5bu9TlLfUTdwq1n

    Score
    10/10
    asyncratrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks