Overview

overview

10

Static

static

3

dd256157a8...42.exe

windows7-x64

10

dd256157a8...42.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd256157a85a12405cbdf789af1b2442

  • Size

    1.8MB

  • Sample

    240524-ssfh5aad8v

  • MD5

    dd256157a85a12405cbdf789af1b2442

  • SHA1

    215b9612eec327982a956ada1c5c9ca0cb934b0b

  • SHA256

    37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d

  • SHA512

    4e6b8dcc6cf00c85d3a68a412555e370a5d63ee480594e7a7ee6f8289e2873ea4b2860d6e5a7e3bd77ea1c079132ecbf9010bb6e47683c6c49ac640357fee2f3

  • SSDEEP

    49152:P1opHluallLeIfGpD+ePfGaBbVoJLshVGbdMeaLaf:N2HluaDp7WmeJaf

Score
10/10
asyncratoro-benditos 2persistencerat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

ORO-BENDITOS 2

C2

krakenstudio061Q.casacam.net:8002

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      dd256157a85a12405cbdf789af1b2442

    • Size

      1.8MB

    • MD5

      dd256157a85a12405cbdf789af1b2442

    • SHA1

      215b9612eec327982a956ada1c5c9ca0cb934b0b

    • SHA256

      37157625bef24977ce0cf11e74b3d5c8412a0638b541e51cc0944b5127b2469d

    • SHA512

      4e6b8dcc6cf00c85d3a68a412555e370a5d63ee480594e7a7ee6f8289e2873ea4b2860d6e5a7e3bd77ea1c079132ecbf9010bb6e47683c6c49ac640357fee2f3

    • SSDEEP

      49152:P1opHluallLeIfGpD+ePfGaBbVoJLshVGbdMeaLaf:N2HluaDp7WmeJaf

    Score
    10/10
    asyncratoro-benditos 2persistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks