General

  • Target

    ZenoExecutor V1 Installer.exe

  • Size

    98KB

  • Sample

    240521-vrzaysce87

  • MD5

    a721d3863b188dbb51d95dcb2d963a44

  • SHA1

    a0ed4f31f78e9b903719b9d788995ba2f830655a

  • SHA256

    0732ec5e0f81b1125c1c5490b25b6b24c55e21b6e16c2d392050c422855da071

  • SHA512

    424c11fd5f1e022ae8b2758fa3dd8f0050393bffb36d66de89dd5973ef960f3e33ab183b6083d3948c3a9098afaaba5c68fab37306f5a2902167f00a2084221a

  • SSDEEP

    3072:hu6FTv2S2q5f3INgibu+HHwJOYprr8jDNSgOEHaZXTJ5x:hu6UfoGgib1HMr8jDUgxQXR

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:1337

192.168.1.11:1337

90.240.254.189:1337

Mutex

NDO9pZJr6iLD

Attributes
  • delay

    3

  • install

    true

  • install_file

    Security.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ZenoExecutor V1 Installer.exe

    • Size

      98KB

    • MD5

      a721d3863b188dbb51d95dcb2d963a44

    • SHA1

      a0ed4f31f78e9b903719b9d788995ba2f830655a

    • SHA256

      0732ec5e0f81b1125c1c5490b25b6b24c55e21b6e16c2d392050c422855da071

    • SHA512

      424c11fd5f1e022ae8b2758fa3dd8f0050393bffb36d66de89dd5973ef960f3e33ab183b6083d3948c3a9098afaaba5c68fab37306f5a2902167f00a2084221a

    • SSDEEP

      3072:hu6FTv2S2q5f3INgibu+HHwJOYprr8jDNSgOEHaZXTJ5x:hu6UfoGgib1HMr8jDUgxQXR

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks