Overview

overview

10

Static

static

1

3.png

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3.png

  • Size

    118KB

  • Sample

    240724-w73tratfmb

  • MD5

    29a09f4651a97213b777612158b7a6c8

  • SHA1

    c57011a73ca0e08efbefdf0021a1b529b1565a07

  • SHA256

    ea5a59097ac39f79bb5d6d473f0e9d3f6bd25d25aed087f05fa5549effbd6c6a

  • SHA512

    ea4d6a876012042556936439dc8bb53a164359a9a4a7a73ef0d4bf348444276749f4ab3df3898cb98ebba31011fa218760ec08bf4a1b02c85ccb056e334d3989

  • SSDEEP

    3072:u/D0I7Yn0PVFnSwJKr7+8vc8iR1dB5M9ly54tjHpaqJTXr:4B7I09Aw8ryR10y54tjJaqJzr

Score
10/10
asyncratdiscoverypersistenceprivilege_escalationrat

Malware Config

Targets

    • Target

      3.png

    • Size

      118KB

    • MD5

      29a09f4651a97213b777612158b7a6c8

    • SHA1

      c57011a73ca0e08efbefdf0021a1b529b1565a07

    • SHA256

      ea5a59097ac39f79bb5d6d473f0e9d3f6bd25d25aed087f05fa5549effbd6c6a

    • SHA512

      ea4d6a876012042556936439dc8bb53a164359a9a4a7a73ef0d4bf348444276749f4ab3df3898cb98ebba31011fa218760ec08bf4a1b02c85ccb056e334d3989

    • SSDEEP

      3072:u/D0I7Yn0PVFnSwJKr7+8vc8iR1dB5M9ly54tjHpaqJTXr:4B7I09Aw8ryR10y54tjJaqJzr

    Score
    10/10
    asyncratdiscoverypersistenceprivilege_escalationrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks