Resubmissions

10-08-2024 11:37

240810-nre4raxekr 10

General

  • Target

    mw3 cheat.rar

  • Size

    28.7MB

  • Sample

    240810-nre4raxekr

  • MD5

    ef448d91d84c3b70dd5f237f649bf7f8

  • SHA1

    c440d41a9ee8438c96792d789a6f3355a77085a0

  • SHA256

    8187eb54b87190f0216bc0c7fa6b1607ad6d957e01281e84cc1a3ec27b38757c

  • SHA512

    9c5dbcb098b8d3ac855f9dfaa19e1dd3f227ee6e1564dbfbb40a7926e2b256660102041b5739408c3436f77bc874e3d436e1edf02bc128da74d959a5dc2116aa

  • SSDEEP

    786432:k0IgUjs2wKPdhtY8tQPr6r/S8eNLU58ryGR4ppi:tijV7PcO/SH65+l4pU

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

o7lab

C2

154.216.20.242:5000

gia.o7lab.me:5000

Mutex

GpMiIzUX7KoW

Attributes
  • delay

    12

  • install

    true

  • install_file

    $77svchost.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      mw3 cheat.rar

    • Size

      28.7MB

    • MD5

      ef448d91d84c3b70dd5f237f649bf7f8

    • SHA1

      c440d41a9ee8438c96792d789a6f3355a77085a0

    • SHA256

      8187eb54b87190f0216bc0c7fa6b1607ad6d957e01281e84cc1a3ec27b38757c

    • SHA512

      9c5dbcb098b8d3ac855f9dfaa19e1dd3f227ee6e1564dbfbb40a7926e2b256660102041b5739408c3436f77bc874e3d436e1edf02bc128da74d959a5dc2116aa

    • SSDEEP

      786432:k0IgUjs2wKPdhtY8tQPr6r/S8eNLU58ryGR4ppi:tijV7PcO/SH65+l4pU

    Score
    3/10
    • Target

      mw3/Database/AppRate.dbd

    • Size

      488KB

    • MD5

      35e6f62ca4d0462ca3cbf542018b051c

    • SHA1

      2cd62ef4b83421f192dd32eefd8a1156afe7923c

    • SHA256

      5bbdefea5009668d43677417772cf9f72c7ab48fb74fb8a65ccc9bec01e7fa25

    • SHA512

      4356e9b8f61527bf6c0d844b9ea9ff6d2b1d90c43c1392c3ae9f164ab8e966bade281d5dca6dfb6cfc27f0603959f39a5ec967cf819743e1e521b23df5e7ef4b

    • SSDEEP

      12288:+U0m/aILw9m1KMdHLMz446fcaTUawBhkeYrJDzqGqn5r:Daaw9m1NlHKnPBhkvJD+Jr

    Score
    3/10
    • Target

      mw3/Database/FB.dbd

    • Size

      1KB

    • MD5

      7658e57a9edaad654541d85395631273

    • SHA1

      e3ab41cddd16542df3be0fa653c846af92ef63e0

    • SHA256

      3959f201a225f64df25cf1098ebb2ddbc6b16654fb4bebd97a8c764e13e134c6

    • SHA512

      b4d040e41eae7eeb0dc6c382ae61c6737c9242636829e61a044eb9abd297791ef4f606623301ef02feebe753ac4994a10a4f21c66a327dc70c014d4f2faec58d

    Score
    3/10
    • Target

      mw3/Database/PSExt.dbd

    • Size

      15KB

    • MD5

      5c94de4a26e6b27f1b705d57a66cfe8a

    • SHA1

      7c6acf210986fa1cc04b2a1ef47e241fa2b0aca3

    • SHA256

      196509a22e2769543b3addbbbd9b685bc4d5d6466635db3a396633b19a61ef25

    • SHA512

      f859949229b19a62bd95abe3f0009babd0685e9ccf2948ca11e9d0ec1a466718465b74812f015b53098ff184174a47fdaacb62bfd4415ef4800c4717321ddbb8

    • SSDEEP

      384:X5t0WWqvBTEm008s0WKD008HxHCiGpL+2oa/Z78QL:X5y/qpYm008V7D008pQQla/9L

    Score
    3/10
    • Target

      mw3/Database/PlugDB.dbd

    • Size

      1.6MB

    • MD5

      d6b298d58686ab7f3c067b24aa493f16

    • SHA1

      3168fd4d2fbeb06d1cef7b9f059521286b769f4a

    • SHA256

      d4897d4d961235a39093e1636ba942a77cb5e3858cfadc26edec1a58981c5550

    • SHA512

      11d804298f7679d72fa410e689f0bec4296c3e71bb4e5de70a95b0083d393a4c18007d700d7332c00c7f0f47e2e98aaa774a936b29ab533ff3d981faaf159618

    • SSDEEP

      49152:QetJR0P/dgR2xEqMC+RalDg2XZ528BjN3Ajy:veP/A2Wq+R7OZfB+y

    Score
    3/10
    • Target

      mw3/Database/PriTemp.dbd

    • Size

      46KB

    • MD5

      0f79baa23989435867c02b58c92209f5

    • SHA1

      dd24cbb18e60ba24879a1c1e110375efa9134cdb

    • SHA256

      3d98b8a32efccaff3b65ccfd6c45c044beca3c6562122bdd06593a49342ed6cd

    • SHA512

      0a334e76ff7f5c5b9d86fa85f47376eeec4589c77cb2d1397f77632c90377e697c7c2895ac88e744335e3fb72f9ba66d35a9f5fd9c084a9de8919fcf70273047

    • SSDEEP

      768:CWpf1/WTi3K8DgTPiLd4pPGxUiURYJfF8tUxGolIYdj9gSzmq0LSryFJ:VOMdgjiLTSxefso64B1+LSOH

    Score
    3/10
    • Target

      mw3/Database/SBData.dbd

    • Size

      4.0MB

    • MD5

      49638ba08bd7ae3555032ea233fb70a4

    • SHA1

      0ba6eaf49bf5d15cd649db3f81ed7ee2ec6b78d2

    • SHA256

      b78690ebba38c0724f770d1747cbb0c83c6eb75ca95b89a99072cbff52bd1845

    • SHA512

      2aa7d8b3caf0955a645f83341d3c7c7d8c6f54ee1ec967a2d77830e058b5030cd155909085f547182ab56d209adc8c14e188917f55e4353004bd1721529d3a51

    • SSDEEP

      98304:jezLN/Than85Eedz9PkzlhV9r5hCI6hv/ZXrWsDur:azLN/Than8OedyBhV9r5hHmRXvu

    Score
    3/10
    • Target

      mw3/Database/SoftHealth.dbd

    • Size

      2.5MB

    • MD5

      c497cdda05228fc74d1a35cd6d0daa49

    • SHA1

      5d6370068fba4b7dd20a2c7c53820dcdb27c5874

    • SHA256

      748670b371864a4adc61a0ff670095fa2258e2e77b580eb75de6549164f039dd

    • SHA512

      c40ede7d40f6b19aa5537dd85b61fdefb1b1c405961e6644e91ffbe3af1f46cca632041662250878823bcd7c11226c5a1dd8c80b9ce9717ffef5d828f6490b0f

    • SSDEEP

      24576:RFzdNeTuX7Ft/goTH0WuLXsESMpRaLMSgXrVwmW9295JbGqk2P7qM+Dh/tT:zKQbgwwbsMp349aTGqBBS

    Score
    3/10
    • Target

      mw3/Database/SoftPM.dbd

    • Size

      872KB

    • MD5

      f1f9e667c2db9ef59b424c33893b7247

    • SHA1

      87480a15568b46a4cbfa6229d9ff1a8c72197e0a

    • SHA256

      d868c6fe89e7539a8cfdc24aba10bebe81ad082a95f3adecdf2bdd9d6f8b94c3

    • SHA512

      db1210a354e74603498b72e9e961f08048bde6515c475303c73a1c650fc5ea4a3d6b864a2252824b069ef5fb99dbea93b9c58a5b44543fce6f935db36f819330

    • SSDEEP

      24576:7km9YheU6J8D6eu0zLsfMn5XKx8QQsXkc+yqwm/dx:L0T/

    Score
    3/10
    • Target

      mw3/Database/UninstallRote.dbd

    • Size

      197KB

    • MD5

      0da5c42122a7120e974a532806f63c26

    • SHA1

      21a2187b48589108402e8d849edc23ae1e72f007

    • SHA256

      dee4a51d185986cf883f312860243467da85f043f8f1ef1132770ce5510b7225

    • SHA512

      913fba5b8d9759896a59200c1086f1c7038bd3593828f75991d698ef0da0329ae7c6d22ac132fd7060b0f600b0a16500d2467bf9cc5b8dafa7dd0b5b75cf7ab5

    • SSDEEP

      3072:57HeRBQ8TKNsj4s1VupQlDmXgV8I0FwsincLmLmmdFPxiSwPwCSKrtPbx+56LH9e:l+nkuTl6XK1bsicgPxFoSM1x+5SHkue

    Score
    3/10
    • Target

      mw3/Database/sMarUpdateInfo.dbd

    • Size

      715KB

    • MD5

      510a2d531992b10faa527d897579a19f

    • SHA1

      c4598a9346090f986781f9b313ce1ee29e5975a9

    • SHA256

      b616aa5867768838793892bd952c4bc85cb1a4ee71d75d9c7ccb3093f22af6fc

    • SHA512

      a12f93e68252c289883d8c82629da9cc6bd448a9c440e6713e9a01882a96525f88ce08b826fcb6bbc5152c94702b3372fdf916e1e7648812531f5220ba133002

    • SSDEEP

      6144:f5hSbKV4AMlzDgCG/eB2ZeSD+nvdyt+NcAhifWZtiCmSQuKVShZiU0Gl939uI8TP:eyKzMFeIvDY4fWjo4y0hZOnfOR/5K

    Score
    3/10
    • Target

      mw3/Database/sUpdate.dbd

    • Size

      98KB

    • MD5

      7ea67b6d7fe2f71dfe030bf04a780244

    • SHA1

      a78a715461e6c9a29f567f55eefc0d10286ee18f

    • SHA256

      272e1e75631f29655adceb59e8f5098cae1c06863925262155fe660682cf37bf

    • SHA512

      528ba8c8c559b0241214f213b4c51c2bcf81b211fe6789da6641c6152d26890066fbd329a59a5079a909e30d120bcd63ead3a14f022b0ee9efa867f7376c3f52

    • SSDEEP

      1536:xiebNRxg9vXori8b/0ie6pa8yPcn1Wa7bbMc38Ym6ARRjtx+Gp8AcYmt:xi+NRS9fj8QieAXn1zcc8uARtP+9L

    Score
    3/10
    • Target

      mw3/Database/uninstall_qdb.dbd

    • Size

      35KB

    • MD5

      4d8b378243c7cf774b51f10c4f2f6375

    • SHA1

      4ca37c7249375bc7b14a7357d306b3aa288025f8

    • SHA256

      d0a736b24467c44dc8419c33e1515a9b5d3bd411fdc76ed6e1f79685060932dc

    • SHA512

      3bf1a76f38663dff587ac5e9b98943193d880006721720c8a1f762b8ef646d4dc44cc798a6be25f60c79d2fbb5f13b1121d111a1d7f28922bd68d901e4f7edd0

    • SSDEEP

      768:98KJ3iGkTvH9iz0OyZbOJr6uxVScuKs8k0EB1+S1/yU:9/iGkRkyxeWMVScuKs8k0E1+S1/N

    Score
    3/10
    • Target

      mw3/Database/usoft.dbd

    • Size

      706KB

    • MD5

      1f89680d894512f660c6b0499df14a87

    • SHA1

      bfea6f406aba9002da6ad7162cd781ac6d8c2a1f

    • SHA256

      1ef55bb0fb54461d51bcbb10a3e499ab41d720981cbb097a5e330b43f6b8a530

    • SHA512

      2ac4ac6da0e90742ee50a1910fcebccfe1270747e2b9363e97a9e0399c22207bca63711b05d63d90ec43d37288249e4d0af53fb5a65fadb1640ec7e4612dc935

    • SSDEEP

      12288:wG9+JaZWhP0A+IxtCYtQ+LznxjS1K0SNKn:V8gZY5+IxcYtQ+LT8E1N8

    Score
    3/10
    • Target

      mw3/Debug/Addition.dll

    • Size

      30KB

    • MD5

      f22e849a370cdf127f48beab596bdd81

    • SHA1

      fb1da47c7a246f2cda7f7686a468efafd9933b1e

    • SHA256

      8be1f5581437b6f5ba48705e8956c8bc0765bbd1d6053242640c75bd94048aa9

    • SHA512

      6ded81fe4d4db69586d74fdb425c4fc8c092508e7e0b49eb141a9045abf40626d14659fa6237a3920e58571ca7acf4911cdf03c4307fd89b6dc5e54172afbc14

    • SSDEEP

      768:Fol18SuOO3bBAughXjNPQsXVjWuu7jqWdTS2gS:er6tAugVjN4sXJYjqWdm2V

    Score
    1/10
    • Target

      mw3/Debug/Autoupdater.ini

    • Size

      5KB

    • MD5

      f78b8f3d265b4e9a706ed0aae70bdf9c

    • SHA1

      6d73ad3954fd8fda80911071efca1910fd2d0a3d

    • SHA256

      dcae62d049c4dd496effab6f02220bc270c6c098ebb55a5a6e55fbafad2974d2

    • SHA512

      c44887c08d1239969aaf9934921f1a7341b87faded169136fcc0539d62de3104ecec0e3ac7a28eb3135cb449f58310b49f868963b64b920210d1c55104e7e7cb

    • SSDEEP

      48:K3Px9Vz69T0oXIGXTWGXsP9JEX98TNx9P8k9zZ8G958d8lx9Vz69T0oXIGXTWGXe:FvTlEGvTlUOy

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks

static1

rato7labasyncrat
Score
10/10

behavioral1

Score
3/10

behavioral2

Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

Score
3/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10