Resubmissions

25-09-2024 13:28

240925-qq3jrs1dja 10

24-09-2024 20:51

240924-zm82taxhle 10

24-09-2024 19:21

240924-x2m2sazhql 10

24-09-2024 19:17

240924-xzhpaazgpj 10

24-09-2024 18:11

240924-wsp94sxcnp 10

24-09-2024 17:54

240924-whcahawgjr 10

General

  • Target

    Anarchy Panel 4.7.7z

  • Size

    52.3MB

  • Sample

    240924-zm82taxhle

  • MD5

    40fa4dfb75a2ff3595435c374a5f5e68

  • SHA1

    2086fd6c2f38fb20e87a50cf3ee27dfb68fa3843

  • SHA256

    bf9aa6957a814d551d3ba7f96690ff76c79ff884718b3a0f16ab17b96c2637ff

  • SHA512

    a0655a97428c2a1981015c7b819a207d119b82fe88242f8a0e703adf3eedd386de73412e428dfce1fcedacbbb04ff23775c66e21584f27b5065ed32f510da3de

  • SSDEEP

    1572864:AN5bnkUpaR1Ju0aVJfQF593gMr8okmaHY5q2iSBHxhj3lF:Q5bkxbJOJfnMYoriIRhX

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:3221

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Anarchy Panel.exe

    • Size

      54.6MB

    • MD5

      94bac1a0cc0dbac256f0d3b4c90648c2

    • SHA1

      4abcb8a31881e88322f6a37cbb24a14a80c6eef2

    • SHA256

      50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94

    • SHA512

      30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9

    • SSDEEP

      786432:RvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj:lPU4bZwm/NwEIYj

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks