Overview

overview

10

Static

static

3

ABA NEW OR...df.exe

windows7-x64

10

ABA NEW OR...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8c8239e1c24546bdc63585199795cd83c07a7a4f00a9cf1bc705035198d2934.img

  • Size

    2.6MB

  • Sample

    240807-ctt5xayckp

  • MD5

    6cd21ef561982b3b486f1ea5d63f8035

  • SHA1

    45c6b094c993aa7831340b581fd31764c770dee8

  • SHA256

    e8c8239e1c24546bdc63585199795cd83c07a7a4f00a9cf1bc705035198d2934

  • SHA512

    915e0f240c5bd5805b3eb61c7522d7cb89188c22e1d7b7bdf164eb8b30cd24314ea56529f087c1a324dd8929f991ea6ba6c8f68daa5d8e3eb28078dc9d326f9f

  • SSDEEP

    6144:gTrjyPf1/pNLbtbTvspnI5p3YCmMuHrXOrfE8HiTAnnQUoJwS4LY5qh:gTWBnjspnIb//XT7EAQPn4LJ

Score
10/10
asyncrat2moneydiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

2MONEY

C2

twart.myfirewall.org:14143

Mutex

FEjYSsXzhpZixwA

Attributes
  • delay

    20

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %Temp%

aes.plain

Targets

    • Target

      ABA NEW ORDER No.2400228341.pdf.exe

    • Size

      2.1MB

    • MD5

      d9d0ba1c1cc0dd9243f36fba8b1147ad

    • SHA1

      eae15f17ee26ede826b934733e16762cd61c89fa

    • SHA256

      37f7dc1e5403ed4babd766ca88445f0c0fd555af19a5b669123660c262cc3f58

    • SHA512

      304503d20998426c25f8f12ff9907831e0184b5ac911a0ce45addec385cac82dc070a56ad8630b404a41023fb56140dda9498d8f1a659a77df2b944ebb6da6b9

    • SSDEEP

      6144:2TrjyPf1/pNLbtbTvspnI5p3YCmMuHrXOrfE8HiTAnnQUoJwS4LY5qhR:2TWBnjspnIb//XT7EAQPn4LJD

    Score
    10/10
    asyncrat2moneydiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks