Overview

overview

10

Static

static

3

2024-07-24...er.exe

windows7-x64

10

2024-07-24...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-07-24_98b445bcd174036d984fdc8271595655_avoslocker

  • Size

    24.0MB

  • Sample

    240725-ad565avhmq

  • MD5

    98b445bcd174036d984fdc8271595655

  • SHA1

    25a765a9c844b28a697ef8b85874989c88f43b9f

  • SHA256

    b5f48fa1fd058f9e60e49ac03924d3bf7f752460bcbdaa442c79dfef9fb9f7e0

  • SHA512

    84f7d886e445264b3136dd8e996b176e519430153ddcb12bc7eed55b957696c8a5a028e3822cd7cfd77a71dc76967d8486642b381d3209d55ac8c08ee4dde818

  • SSDEEP

    49152:ZqH7Bei/m+1q1BFx3unxRLC4PAl6mdTdUxK/ZayP3pgXWFVeVpPsSvPkD+z:M+7ZFVeVpU

Score
10/10
asyncrat23-juliodiscoverypersistencerat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

23-Julio

C2

tenfreehse.dynuddns.net:22077

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      2024-07-24_98b445bcd174036d984fdc8271595655_avoslocker

    • Size

      24.0MB

    • MD5

      98b445bcd174036d984fdc8271595655

    • SHA1

      25a765a9c844b28a697ef8b85874989c88f43b9f

    • SHA256

      b5f48fa1fd058f9e60e49ac03924d3bf7f752460bcbdaa442c79dfef9fb9f7e0

    • SHA512

      84f7d886e445264b3136dd8e996b176e519430153ddcb12bc7eed55b957696c8a5a028e3822cd7cfd77a71dc76967d8486642b381d3209d55ac8c08ee4dde818

    • SSDEEP

      49152:ZqH7Bei/m+1q1BFx3unxRLC4PAl6mdTdUxK/ZayP3pgXWFVeVpPsSvPkD+z:M+7ZFVeVpU

    Score
    10/10
    asyncrat23-juliodiscoverypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks