Overview

overview

10

Static

static

3

9f8e77d169...4c.exe

windows7-x64

10

9f8e77d169...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f8e77d169d89429ec407c149ed7bbd250a6e73d5f3cb2dfa763c25bc536e24c

  • Size

    266KB

  • Sample

    240729-clfybaxfpq

  • MD5

    fb84b1ee150e9cb0115c4751a749b8c1

  • SHA1

    9cf720e82bc95cfae844597b3bb6f2798333e5ca

  • SHA256

    9f8e77d169d89429ec407c149ed7bbd250a6e73d5f3cb2dfa763c25bc536e24c

  • SHA512

    6ae10558a815a8c0c6cb26edd31c4ca43135d3f26cdc02d98e92c9c7b4b4cee9911bc32ec6a228e8d0c3d705637a5485a46b217b4b3f9803eddb46a3c4e222b6

  • SSDEEP

    3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/v:WFzDqa86hV6uRRqX1evPlwAn

Score
10/10
asyncratdiscoverypersistencerat

Malware Config

Targets

    • Target

      9f8e77d169d89429ec407c149ed7bbd250a6e73d5f3cb2dfa763c25bc536e24c

    • Size

      266KB

    • MD5

      fb84b1ee150e9cb0115c4751a749b8c1

    • SHA1

      9cf720e82bc95cfae844597b3bb6f2798333e5ca

    • SHA256

      9f8e77d169d89429ec407c149ed7bbd250a6e73d5f3cb2dfa763c25bc536e24c

    • SHA512

      6ae10558a815a8c0c6cb26edd31c4ca43135d3f26cdc02d98e92c9c7b4b4cee9911bc32ec6a228e8d0c3d705637a5485a46b217b4b3f9803eddb46a3c4e222b6

    • SSDEEP

      3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/v:WFzDqa86hV6uRRqX1evPlwAn

    Score
    10/10
    asyncratdiscoverypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks