Overview

overview

10

Static

static

3

sample.exe

windows7-x64

8

sample.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order._1.exe.bz2

  • Size

    76KB

  • Sample

    240730-k6q8sazfrc

  • MD5

    5b1c8e46e216c0297ac8de47ef83a916

  • SHA1

    7d1d7049fb2ba334b9d14c213678b20103c27e09

  • SHA256

    a9954799549b2110e7a9db4ff0656899cd083387c9e31f06dcab6ebdb75b3fba

  • SHA512

    d46db3df0c4cbce1b77cefea03335cf5f3786b163418f919e61fe3df856cf4d75fb160d5161c8a13673b8c40473777110bb58b3310b740a6d7bf4153f6b03c42

  • SSDEEP

    1536:4+hVa+EfWgi8c8KlGLFT7YbbjmcJDyspGlzOYCuktxi+a6:xHgTcPkQbbjxpPr9a6

Score
10/10
asyncratdefaultdiscoveryexecutionpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

192.228.105.2:7707

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    svchst.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      sample

    • Size

      288KB

    • MD5

      587be0c9be93274c3d38ef27c3a50aa4

    • SHA1

      6808c0da1276c7ad2021ffb7c0b8d743f5c87b35

    • SHA256

      cf4ff6cb9038c130e7b6d76daf2af62d018541c3d561d5e0aba8a34614ebc5d8

    • SHA512

      5d2dbadb93ae2d91c3e7af58be9b28a7270a86b1c3b2bfbae64f232a06f26efa72162dc4adb22ce1f269429eecb2d4b5b44e1c1494658de702c1f2dad0c9c879

    • SSDEEP

      3072:Cq6+ouCpk2mpcWJ0r+QNTBf2Wk1qXkXRA4XTZ5N:Cldk1cWQRNTB+l8KN

    Score
    10/10
    discoveryexecutionasyncratdefaultpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Downloads MZ/PE file

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks