Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-10-2024 17:24
General
-
Target
Python3.10.10.exe
-
Size
125KB
-
MD5
8711c6bb4010b6f2121df070e53bb5a3
-
SHA1
8516e5d743cdff42b7d3076934acada5b32f7a33
-
SHA256
0cf42fde881dcc40e7825960da67628f47c889858b717fcb8850193152d9d5a8
-
SHA512
d2300649efc3f39339a3213a66a99f66bcdc16beac0d21447f2cc1ae1fe60cab41ed8b9539d8d09317a97b43d89a722ead568db12d62f036394cfcd1154cc863
-
SSDEEP
3072:DugOTAwv29+cBzbxjyNgpnGW+0Xhrj/IRM3sntH:Dugme0ctbpfZGEFbq
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/s14cUU5G
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Python3.10.10.exe"C:\Users\Admin\AppData\Local\Temp\Python3.10.10.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB