Overview

overview

10

Static

static

1

Zkfi.html

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Zkfi

  • Size

    20KB

  • Sample

    241011-ad176stgnf

  • MD5

    a96903d3ed4d88d61069e17916482963

  • SHA1

    4be7c346c472640a01e94a118fc8d8c5e3357d21

  • SHA256

    900b26aa692bc4c3633f2dab0e661c896c2b00868ce2eb6c95fe7ee8665527d9

  • SHA512

    77b082448733da9685ad93fc7973d41ee79674c43bebfbedd8e5ac6263c6ab071b0a5f6ee48634b03bfd32f39dd80b5c940123fafe67add79779c9004b1ed0a9

  • SSDEEP

    192:nQ7hEoDgxUpeWw9y89uQABYOfNwsC8xZXIQhVaEa2i8ca1Wb/:nQeuyAHFtBdaEaU1Wr

Score
10/10
asyncratdefaultdefense_evasiondiscoverypersistencerat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

production-loading.gl.at.ply.gg:48573

Attributes
  • delay

    1

  • install

    true

  • install_file

    svcohost.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Zkfi

    • Size

      20KB

    • MD5

      a96903d3ed4d88d61069e17916482963

    • SHA1

      4be7c346c472640a01e94a118fc8d8c5e3357d21

    • SHA256

      900b26aa692bc4c3633f2dab0e661c896c2b00868ce2eb6c95fe7ee8665527d9

    • SHA512

      77b082448733da9685ad93fc7973d41ee79674c43bebfbedd8e5ac6263c6ab071b0a5f6ee48634b03bfd32f39dd80b5c940123fafe67add79779c9004b1ed0a9

    • SSDEEP

      192:nQ7hEoDgxUpeWw9y89uQABYOfNwsC8xZXIQhVaEa2i8ca1Wb/:nQeuyAHFtBdaEaU1Wr

    Score
    10/10
    asyncratdefaultdefense_evasiondiscoverypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Downloads MZ/PE file

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks