Overview

overview

10

Static

static

1

2fc1ec3963...a7.ps1

windows7-x64

3

2fc1ec3963...a7.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12e2abc893dc6797d3fa02525df2b9e2.bin

  • Size

    87KB

  • Sample

    240802-bvmxjsxdpn

  • MD5

    0befc18f3677cabad8f8efd082f348fa

  • SHA1

    7728c753643edfe12f533379b91e3d596b41b1c1

  • SHA256

    ec4b0ef32d330158006ce6d20c41eefc67924b50d95364cc961e8b008ed93d4b

  • SHA512

    40abfa3f53e40b912b4f58d24ea8e3329f67b8a90cb2b44e9616182f3afa18a9e6d2dc6001b99c5c3ff256bd0402560524c82db626baba8f7352f3fa5cc6684a

  • SSDEEP

    1536:NoNqrJ+VnzxHX0mbeGCOhgQuHNhVQjdvQDq/jn93NsPfEcnfEC+/dUfobZn4giXl:NoNqrJinlFbdCSVgq/j93efEMfMOot45

Score
10/10
asyncratwe need moneydiscoveryexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

we need money

C2

backwork07.ddns.net:6666

Mutex

AsyncMutex_VVXVZFyTYtHWDAzB

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      2fc1ec39637b7e1f46ed594c12c80fb8186b1fbbe6cd2893ffdc36690505a5a7.ps1

    • Size

      553KB

    • MD5

      12e2abc893dc6797d3fa02525df2b9e2

    • SHA1

      10f78d47a520c02525d6a33ae9f3698c1de02413

    • SHA256

      2fc1ec39637b7e1f46ed594c12c80fb8186b1fbbe6cd2893ffdc36690505a5a7

    • SHA512

      b960fb6110be0f77e65054cae7f8d935cec4cd6f55a782fe0f6c7dcc5ee2630d229fdf0ab218fae856a2adb39b6b95237e4ed75cd707bd895d5ba2035e42a7a4

    • SSDEEP

      1536:kDh8DyXBs84VhDEak0EyxWq0Z3IMUlaE4g7:kDhiyXBs84VhDEakbyxWq0Zk

    Score
    10/10
    executionasyncratwe need moneydiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks