Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 16:40
General
-
Target
bazaar.2020.02/HEUR-Backdoor.MSIL.Crysan.exe
-
Size
46KB
-
MD5
b0ccfc015178530287777e5feae9a884
-
SHA1
4b688412891cd85a7dd507134e8d5f7d81163ab9
-
SHA256
5be5dbcf6753c5607b5c95bf93e71f1d71fcb2c6ff691f949e237bc6df77a34a
-
SHA512
c837315f3481636872bf642729ebcc9b286fb834099ef488dd8f1f4f5cf589b9a8ca18718ff4a14d1c4ff95c33e29239475dace168156125fdaf85da3b737f15
-
SSDEEP
768:8qLytbXZ+uuTkOicvHk3eHlWMPbPgF0qoW/0aYaMtiYI6OC62tYcFmVc6K:8HuTXvZH0ub4FrlMaYaMw6OPKmVcl
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.6A
Botnet
null
C2
62.108.37.42:8808
Mutex
NcRfUjXn2r5u8x/A?D*G-KaPdSgVkYp3s6v9y$B&E)H+MbQeThWmZq4t7w!z%C*
Attributes
-
delay
3
-
install
false
-
install_file
Main.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Crysan.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB