General

  • Target

    skibidirat.exe

  • Size

    16.4MB

  • Sample

    241020-s8exjayakj

  • MD5

    266764b1328dfba596ec0fbf5feca39a

  • SHA1

    099c1d1750238b9e6ab0979c9cff8493c4f3c373

  • SHA256

    300838a1445ba35fcf31f65018293d8cb9a7bfe0c4859b26205c09be3a7b3b3d

  • SHA512

    f6f69498be690023553f4aabba26f27a0cdf3c68f405ffc76637eb6c933c1061bb92c40934276cb7751f6061de515e4f8ded12fef1c93a533dbbfb1c395ceea8

  • SSDEEP

    196608:EVCpPOu8P5G2eee0yMRs4vkmXaU7aIObk9fcdHJDLscmZk36zOAE2A1cZF7sL9YR:2kr0TaZ1LmZ+F1cby9YN/X

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

natural-familiar.gl.at.ply.gg:65030

Attributes
  • delay

    1

  • install

    true

  • install_file

    search.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      skibidirat.exe

    • Size

      16.4MB

    • MD5

      266764b1328dfba596ec0fbf5feca39a

    • SHA1

      099c1d1750238b9e6ab0979c9cff8493c4f3c373

    • SHA256

      300838a1445ba35fcf31f65018293d8cb9a7bfe0c4859b26205c09be3a7b3b3d

    • SHA512

      f6f69498be690023553f4aabba26f27a0cdf3c68f405ffc76637eb6c933c1061bb92c40934276cb7751f6061de515e4f8ded12fef1c93a533dbbfb1c395ceea8

    • SSDEEP

      196608:EVCpPOu8P5G2eee0yMRs4vkmXaU7aIObk9fcdHJDLscmZk36zOAE2A1cZF7sL9YR:2kr0TaZ1LmZ+F1cby9YN/X

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Async RAT payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks