Overview

overview

10

Static

static

1

ORDER-24603909AF.js

windows7-x64

10

ORDER-24603909AF.js

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ORDER-24603909AF_1.tar

  • Size

    764B

  • Sample

    240603-sklp6sae21

  • MD5

    4b6a76c05607f5e7d28daad5214c4fcc

  • SHA1

    759a7c43be50022280976fefbabe27a16e7d4c16

  • SHA256

    829fcf481eccee4d91cffb6e6c1eef3048cab4a9ac10a6c65397bc8b70f06f66

  • SHA512

    c45f73081a09be3b2a1f3b46653ef2457ae713156de2a5dfe0f6142c3f556a64e64b251308b214d57782d11771e2eb9af297d433b25ffabd75cabeab1bbd7adf

Score
10/10
asyncratexecutionrat

Malware Config

Targets

    • Target

      ORDER-24603909AF.js

    • Size

      8KB

    • MD5

      8bc951c9580b40a1b7c6222613b97da4

    • SHA1

      ffeed34cea7de42eb7b1262113ef3c753ae121c0

    • SHA256

      a47fb3147b531316317dd8150333f7417f6fe196f0ef8656babb070e37d9cc0d

    • SHA512

      5b07d8c2ed5c1a6ea604dfac05a598756e5fa2dfe3db5d3e4219e3752bad176a1b5b8f1f29c7b44513e0939e16ee4d8388c31e6fd232e262a28fbfbf04023bc8

    • SSDEEP

      48:1PueRvRbecveUMW9gdueHhUfJawYYueihb+EKpOFwSmvkuess9vGbFKpbbyh:Zz5FMYoBnmaLKpD+mZ

    Score
    10/10
    asyncratexecutionrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks