Overview

overview

10

Static

static

3

DOCMANGLOE...65.exe

windows7-x64

10

DOCMANGLOE...65.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    26072024_0249_DOCMANGLOEUDHDKFI192461285901459370142836954352649435465765.zip
  • Size 1.4MB
  • Sample240726-da27vavdnf
  • SHA256 8e746957ef98a98e2256e7816fce3aaf25aad3411dc4743de943bc55285079e7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratgoogleediscoverypersistencerat

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.7A

Botnet

  • GOOGLEE

C2

  • googlee.con-ip.com:6606

Mutex

  • uuooxuxbnkywum

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      DOCMANGLOEUDHDKFI192461285901459370142836954352649435465765.exe
    • Size 1.5MB
    • SHA256 5bf3776166740f64879e1071a54267e70c53bd72856f74f71a1e5c8e72138446
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    asyncratgoogleediscoverypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks