Overview

overview

10

Static

static

3

DOCMANGLOE...65.exe

windows7-x64

10

DOCMANGLOE...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26072024_0249_DOCMANGLOEUDHDKFI192461285901459370142836954352649435465765.zip

  • Size

    1.4MB

  • Sample

    240726-da27vavdnf

  • MD5

    d49640ba0540b79c298aea58a66d4a35

  • SHA1

    e8c7160a6f36696d685f7e1d44193e00eeaa17e1

  • SHA256

    8e746957ef98a98e2256e7816fce3aaf25aad3411dc4743de943bc55285079e7

  • SHA512

    7090b377a3a1ed00d31fe16c2adc9202367ec17ed14cbbd9e2f71bd112f17a7752578d21174c5718b38c38c95967d0db083f534bb31bac9847b23b6c05801905

  • SSDEEP

    24576:b3BlvSORqC0IViDDU4wcCB94jRMP+0jUE8JgKu2b7hjIWiMmwROlhRIx:b3Du1pDDU4QBGjqP+qAJgi7hkWiMd0lu

Score
10/10
asyncratgoogleediscoverypersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

GOOGLEE

C2

googlee.con-ip.com:6606

Mutex

uuooxuxbnkywum

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      DOCMANGLOEUDHDKFI192461285901459370142836954352649435465765.exe

    • Size

      1.5MB

    • MD5

      72238a6294d8fef681a753d016d3af66

    • SHA1

      9319816cff4c484238d521fa52c52c41491bfd99

    • SHA256

      5bf3776166740f64879e1071a54267e70c53bd72856f74f71a1e5c8e72138446

    • SHA512

      03370c451b2159eb1cbfd995d4a9d98eacd3b178d22b31b2972e9287350b5a2b40c689438d4a258434c1e8a865612401636db7a2ef41982b1253fbd9905a8f00

    • SSDEEP

      24576:S4tIRuKO8VB4ZWR4wkEQV7DGsIKa26u41K/HqOdvn4WzJWjuj5L:SyB8syrRCqWL6psHqOB4Wze25

    Score
    10/10
    asyncratgoogleediscoverypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks