asyncrat | 9aed3c4a1c34622dae06f7c3db0e9b7f354ddecf6aed04c38f2dac26e65bd5fe | Triage

Sharing

General

Target

c56dc633c65434f91dd1a94a3044ed30_NeikiAnalytics.exe
Size

337KB
Sample

240525-dcnr8scc32
MD5

c56dc633c65434f91dd1a94a3044ed30
SHA1

4a904dd388f380c7dfa0cbaa31b1a48cd0f57c48
SHA256

9aed3c4a1c34622dae06f7c3db0e9b7f354ddecf6aed04c38f2dac26e65bd5fe
SHA512

738a23eecbe58ce4178073ec8175d0e58416cdc38c3943ff06e90b82babb044b83b9f485284ad2d6bfe3a7c209f7ba6f837d1c2a8ac2291e430a1873e61cdc45
SSDEEP

6144:sG0rAr2A+8QkxNdmBU0Z+hhZSo46MF6lv08YSmznZI:FvaAZQkjdmBjQVS635rYSmzni

Score

10^/10

asyncrat defaultacs2 rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

DefaultACS2

C2

fanejkbdfjgjziu.sytes.net:8808

fanejkbdfjgjziu.sytes.net:7707

fanejkbdfjgjziu.sytes.net:8678

danmucjydcdyty.sytes.net:8808

danmucjydcdyty.sytes.net:7707

danmucjydcdyty.sytes.net:8678

awmucffjydfyj.sytes.net:8808

awmucffjydfyj.sytes.net:7707

awmucffjydfyj.sytes.net:8678

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
500
install
true
install_file
drb.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  c56dc633c65434f91dd1a94a3044ed30_NeikiAnalytics.exe
- Size
  
  337KB
- MD5
  
  c56dc633c65434f91dd1a94a3044ed30
- SHA1
  
  4a904dd388f380c7dfa0cbaa31b1a48cd0f57c48
- SHA256
  
  9aed3c4a1c34622dae06f7c3db0e9b7f354ddecf6aed04c38f2dac26e65bd5fe
- SHA512
  
  738a23eecbe58ce4178073ec8175d0e58416cdc38c3943ff06e90b82babb044b83b9f485284ad2d6bfe3a7c209f7ba6f837d1c2a8ac2291e430a1873e61cdc45
- SSDEEP
  
  6144:sG0rAr2A+8QkxNdmBU0Z+hhZSo46MF6lv08YSmznZI:FvaAZQkjdmBjQVS635rYSmzni
Score

10^/10

asyncrat defaultacs2 rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

asyncratdefaultacs2rat

behavioral2