Overview

overview

10

Static

static

3

dfsdfsefsdf.exe

windows7-x64

7

dfsdfsefsdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfsdfsefsdf.exe

  • Size

    314KB

  • Sample

    240803-r3da3s1cqg

  • MD5

    1e70b1f2dfa3d0fac7676bf4c640ab26

  • SHA1

    212ec263d1ad3d8b253ab333add181f05ab29f5f

  • SHA256

    01acf24e5951a2d6d9723153be9bded08a12a93eb0d2d23296e46946398ad47d

  • SHA512

    599a624c274069f011c580419dab9484b1efd23881cadb1b740809c6a29325ff2d2b3b0b828ea9ba0d37e83fb524b8d5052b8a9151be56b9d6cc503cedefb9c9

  • SSDEEP

    6144:CUGv5Qw2U2sdKRUtlKZIIHDmu+Bi2OQbQzyu:qvOwrrdPIauCysQP

Score
10/10
asyncratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

127.0.0.1:448

127.0.0.1:30335

147.185.221.21:4449

147.185.221.21:448

147.185.221.21:30335
Mutex

svgzneojcizyxlbkbtz

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      dfsdfsefsdf.exe

    • Size

      314KB

    • MD5

      1e70b1f2dfa3d0fac7676bf4c640ab26

    • SHA1

      212ec263d1ad3d8b253ab333add181f05ab29f5f

    • SHA256

      01acf24e5951a2d6d9723153be9bded08a12a93eb0d2d23296e46946398ad47d

    • SHA512

      599a624c274069f011c580419dab9484b1efd23881cadb1b740809c6a29325ff2d2b3b0b828ea9ba0d37e83fb524b8d5052b8a9151be56b9d6cc503cedefb9c9

    • SSDEEP

      6144:CUGv5Qw2U2sdKRUtlKZIIHDmu+Bi2OQbQzyu:qvOwrrdPIauCysQP

    Score
    10/10
    discoveryasyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks