Overview

overview

10

Static

static

10

Infected.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Infected.exe

  • Size

    63KB

  • Sample

    240808-s35k1ayhkb

  • MD5

    885f0908a5c74a41716e8ade2dc612fd

  • SHA1

    5a5503fcece1e64decf4dbff9d2a98f8a360826f

  • SHA256

    1bafd535f75c0da3eda221884b50998cbb2dc20175da8054dbbe2530b111bba9

  • SHA512

    bd525bf9ce956042617b107f521c6c633a9b3f3f57df0a2ad972048765ecf8719b847669fd1b499fe4bde1acfa5c57522e775f735825c4e708eebcc94a87fe4a

  • SSDEEP

    768:3ig6BqomfHz4c78F3C8A+XuiazcBRL5JTk1+T4KSBGHmDbD/ph0oXZNGSuMdpqKX:++4/FdSJYUbdh9ZvuMdpqKmY7

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:3232

127.0.0.1:4040

https://6eeb-109-103-52-164:3232

https://6eeb-109-103-52-164:4040
Attributes
  • delay

    3

  • install

    true

  • install_file

    spoofer.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Infected.exe

    • Size

      63KB

    • MD5

      885f0908a5c74a41716e8ade2dc612fd

    • SHA1

      5a5503fcece1e64decf4dbff9d2a98f8a360826f

    • SHA256

      1bafd535f75c0da3eda221884b50998cbb2dc20175da8054dbbe2530b111bba9

    • SHA512

      bd525bf9ce956042617b107f521c6c633a9b3f3f57df0a2ad972048765ecf8719b847669fd1b499fe4bde1acfa5c57522e775f735825c4e708eebcc94a87fe4a

    • SSDEEP

      768:3ig6BqomfHz4c78F3C8A+XuiazcBRL5JTk1+T4KSBGHmDbD/ph0oXZNGSuMdpqKX:++4/FdSJYUbdh9ZvuMdpqKmY7

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks