Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://bit.ly/birth...

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://bit.ly/birthdaypres2024

  • Sample

    240529-j7t6dsha92

Score
10/10
asyncratworkexecutionrat

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    94.232.249.78
  • Port:
    21
  • Username:
    ftpuser
  • Password:
    #7!KfLm9$dP3*zVq5@6c2w8x0eRtYsZa

Extracted

Family

asyncrat

Version

Alfa Red Fox V1

Botnet

Work

C2

193.187.175.70:8080

Mutex

zgiaunswkspbznol

Attributes
  • delay

    1

  • install

    true

  • install_file

    SystemDriversUpdateService.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      https://bit.ly/birthdaypres2024

    Score
    10/10
    asyncratworkexecutionrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks