Overview

overview

10

Static

static

1

.html

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    .

  • Size

    1KB

  • Sample

    240713-t86kxs1cqf

  • MD5

    84238dfc8092e5d9c0dac8ef93371a07

  • SHA1

    4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047

  • SHA256

    ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9

  • SHA512

    d06b93c883f8126a04589937a884032df031b05518eed9d433efb6447834df2596aebd500d69b8283e5702d988ed49655ae654c1683c7a4ae58bfa6b92f2b73a

Score
10/10
asyncratrhadamanthystoxiceyedefagilenetratstealertrojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot5687152406:AAFin_LYFhJGLydMgYheeUDec-2orew51aM/sendMessage?chat_id=2024893777

https://api.telegram.org/bot5536756167:AAFMcQrFbMZMBynbrtZUudaOT9ndCJXIqT4/sendMessage?chat_id=2024893777

Extracted

Family

asyncrat

Version

1.0.7

Botnet

def

C2

37.18.62.18:8060

Mutex

era2312swe12-1213rsgdkms23

Attributes
  • delay

    1

  • install

    true

  • install_file

    CCXProcess.exe

  • install_folder

    %Temp%

aes.plain

Targets

    • Target

      .

    • Size

      1KB

    • MD5

      84238dfc8092e5d9c0dac8ef93371a07

    • SHA1

      4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047

    • SHA256

      ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9

    • SHA512

      d06b93c883f8126a04589937a884032df031b05518eed9d433efb6447834df2596aebd500d69b8283e5702d988ed49655ae654c1683c7a4ae58bfa6b92f2b73a

    Score
    10/10
    asyncratrhadamanthystoxiceyedefagilenetratstealertrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • ToxicEye

      ToxicEye is a trojan written in C#.

      rattrojantoxiceye

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks