asyncrat | 60f8e250f3c0fbbc3088cb762a14322532a4c183e86287532534d38f2f2e79e7 | Triage

Sharing

General

Target

Fspufeg_LetThereBeCarnage.exe
Size

176KB
Sample

241108-z6cgyssndn
MD5

b1fe8bd5e597eca5c117126d841620a8
SHA1

096038125468f8eb1e91e62233f7569b9ac4e4fa
SHA256

60f8e250f3c0fbbc3088cb762a14322532a4c183e86287532534d38f2f2e79e7
SHA512

4823e1df90e4de43e31db17dc750f2f7f4cd4948a43e2287d7982eaec6fcc7a612e1e2b543ef6391ff09b1fb02cd95953f5732041922adea6b65384c47f2006c
SSDEEP

3072:pUdsvwe0jmKhy2BQ9bwjjdyqyqA0FCWfJz6gUlDCfz6:Mf5hy2BQ9bmjdyqyqBFCWfJzGim

Score

10^/10

asyncrat defense_evasion execution persistence rat

Malware Config

Targets

- Target
  
  Fspufeg_LetThereBeCarnage.exe
- Size
  
  176KB
- MD5
  
  b1fe8bd5e597eca5c117126d841620a8
- SHA1
  
  096038125468f8eb1e91e62233f7569b9ac4e4fa
- SHA256
  
  60f8e250f3c0fbbc3088cb762a14322532a4c183e86287532534d38f2f2e79e7
- SHA512
  
  4823e1df90e4de43e31db17dc750f2f7f4cd4948a43e2287d7982eaec6fcc7a612e1e2b543ef6391ff09b1fb02cd95953f5732041922adea6b65384c47f2006c
- SSDEEP
  
  3072:pUdsvwe0jmKhy2BQ9bwjjdyqyqA0FCWfJz6gUlDCfz6:Mf5hy2BQ9bmjdyqyqBFCWfJzGim
Score

10^/10

asyncrat defense_evasion execution persistence rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Asyncrat family
  asyncrat
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Obfuscated Files or Information

Command Obfuscation

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

asyncratdefense_evasionexecutionpersistencerat