Overview

overview

10

Static

static

10

ev53/Hanzo...on.exe

windows7-x64

3

ev53/Hanzo...on.exe

windows10-2004-x64

3

ev53/rat.exe

windows7-x64

10

ev53/rat.exe

windows10-2004-x64

10

ev53/svchost.exe

windows7-x64

1

ev53/svchost.exe

windows10-2004-x64

1

ev53/win.exe

windows7-x64

1

ev53/win.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e7bc173737fe772efc1c2eb2907fac3e2627c74dc6a79702ab2e3767ecadd08f

  • Size

    164KB

  • Sample

    240806-kf11asvcjj

  • MD5

    3a70630e68f10284344a6be7d5c36b8c

  • SHA1

    bce96cadc27185b8bb5215c53c8d3774f3c54f0c

  • SHA256

    e7bc173737fe772efc1c2eb2907fac3e2627c74dc6a79702ab2e3767ecadd08f

  • SHA512

    574c6efb6570d62cf1b5c66e37adc0c9bfabd910c6754ea7310abeae781d683caa2640d6b49bc69aeaeffe7567b7a8a087c4fbb9496f8c5cd250dda3bb19fd24

  • SSDEEP

    3072:FO0sdSH7m0IJrecvuBNhmWZNg6/SCvFBIJrecvuBNhmWZNg6/SCvF7:FiAH7mpJrBgvmWw6/EJrBgvmWw6/5

Score
10/10
asyncratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808
Mutex

PdDNmgn3zUw9

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ev53/HanzoInjection.exe

    • Size

      23KB

    • MD5

      3c2a8db247527288a270e1576d7ce508

    • SHA1

      ee5931476a0469fd6bfcbe0bf3f611a54e87e07b

    • SHA256

      26eb454fac222152fca9b79a2f782d4ad0ed774e5b857f808ceeee29f9901286

    • SHA512

      235f419ef8d0de335dd41cca426369bc6739c92a9e957006f8557d56dfb17c50b0745c4313e1c298bdfe20b7f3f9e7f20ca873dfc1d39d4377a3fc447456d355

    • SSDEEP

      384:pWtHSrBpg9mTvbJkAUwRoKJCFEgfJa5MzG9p:eHSrBe9sDzUwRx/gfJa5T7

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      ev53/rat.exe

    • Size

      47KB

    • MD5

      c60ed1d15c53b69514460917c8bb2e7c

    • SHA1

      2bc0190b6b555006631f4a94938f75599112b39d

    • SHA256

      8a9aed3b11fb185fc843fbffce68c192140e50bc6ab6966cea5febc9a123f813

    • SHA512

      66eac1c4d87d0bab341e60a4b66dc8603267133ab1954a1fecea1c63eb65ad647fc06ec9947bc86d2a63aab463b403ffeae22bb8b970d1e21e2d5b0bc9938c92

    • SSDEEP

      768:Bu/dRTUo0HQbWUnmjSmo2qM6pyyZBvvPI4WR0nqK0bMqvaQ/+xuPn4e/FXJGBDZN:Bu/dRTUPE2yrvo4WynqVbMqvtkuPn4eg

    Score
    10/10
    asyncratdefaultdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat
    behavioral3behavioral4

    • Target

      ev53/svchost.exe

    • Size

      130KB

    • MD5

      03f16a9a58ce846100ec677185a24637

    • SHA1

      bd2a1f471e7d4eab278d8ca218c3916a591fdc5c

    • SHA256

      2e2306c1fdc3c395db82714168e84316701e642fa3355fd803ed084650d2cc7a

    • SHA512

      54b8ab596d11566feb671bc8cf8c09806d2e54afa29939a2d8189e0e7c952fbdc6db3b061c3a13d765965d3aef257d0821c4a31ecc2468012d6d238fbcda0737

    • SSDEEP

      3072:QO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6oE:QO5n5d56TYZQnB+Dpekyyqm

    Score
    1/10
    behavioral5behavioral6

    • Target

      ev53/win.exe

    • Size

      130KB

    • MD5

      03f16a9a58ce846100ec677185a24637

    • SHA1

      bd2a1f471e7d4eab278d8ca218c3916a591fdc5c

    • SHA256

      2e2306c1fdc3c395db82714168e84316701e642fa3355fd803ed084650d2cc7a

    • SHA512

      54b8ab596d11566feb671bc8cf8c09806d2e54afa29939a2d8189e0e7c952fbdc6db3b061c3a13d765965d3aef257d0821c4a31ecc2468012d6d238fbcda0737

    • SSDEEP

      3072:QO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6oE:QO5n5d56TYZQnB+Dpekyyqm

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks