Overview

overview

10

Static

static

10

3caa5f0600...d5.exe

windows7-x64

10

3caa5f0600...d5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    375c43c645f68b4ee517958f959233dd55a108408a961e6e74bc901bf691494d

  • Size

    35KB

  • Sample

    240524-ss47gsag77

  • MD5

    9ede2cdd05ef536550ea82faadcb0f64

  • SHA1

    f8a48cc3a2eac967a9965218646bb981cd4cc454

  • SHA256

    375c43c645f68b4ee517958f959233dd55a108408a961e6e74bc901bf691494d

  • SHA512

    ea3bdb6b18548aef954406dab5db8c81e0b848d9596995887dd3d3f54636ecf953ccfb38eefb528dc7dd914a26bddf3eab92f31d75c4f4782556026ef556bd0e

  • SSDEEP

    768:ywO6O3I2HIlotf4RSnTVSfQDRdhRZlroK63agjo++2qCyIFFATmZz2:ywOr3I2JfK0VbjoK63agjheCyIF2TmZC

Score
10/10
asyncratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

66.235.168.242:4449

Mutex

scgofjarww

Attributes
  • delay

    1

  • install

    true

  • install_file

    Loader.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5

    • Size

      74KB

    • MD5

      7ac0adf482250172280defec7a7054da

    • SHA1

      20a25f0da68c309d062c4628ead8b6f377ac7969

    • SHA256

      3caa5f06008365fbecf46198744793c36c42309b49a6324bebe8123be10f87d5

    • SHA512

      d03d033b931f3d39f95a1ec1cdc7d9014783f11b2438c265dd72c0bc34f9d5ced534a38c7c1c88ff930868fd9cf60521dd556b5c486c5cf364f798f39215a1aa

    • SSDEEP

      1536:WUxQcxHCapCtGPMVCe9VdQuDI6H1bf/yBZUu7QzciLVclN:WUOcxHCoeGPMVCe9VdQsH1bfqvUwQzBY

    Score
    10/10
    asyncratdefaultdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks