Analysis
-
max time kernel
114s -
max time network
115s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
09-11-2024 21:03
General
-
Target
ftghrkopokpo.exe
-
Size
45KB
-
MD5
136b8d472112a96677d31d890f51698b
-
SHA1
b14a5a236cb8239ebc6da1d8813dc01a043027a8
-
SHA256
07bfcbb1262015c8ba7b2e63d4c34b5a6aee4595c3093c1da59bb4facd77a286
-
SHA512
1955571051f0c6165711e0bfd454cee3d22593d23226ef27cb3aff2aa3f4511f56421ec2f86e6a58bce1c27b4a86c8ccd6ebe278ca465884d21e8f6ba6f847af
-
SSDEEP
768:ZuxoNTRgXtrWUXfy5mo2q7ffJJ2qMa55OPIHzjbugX5ihIUqC35JZBDZrx:ZuxoNTRUu2QaKf3H3bRXIhIUZ3vdrx
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:62565
127.0.0.1:139
Cristopher11sa-62565.portmap.host:6606
Cristopher11sa-62565.portmap.host:7707
Cristopher11sa-62565.portmap.host:8808
Cristopher11sa-62565.portmap.host:62565
Cristopher11sa-62565.portmap.host:139
190.104.116.8:6606
190.104.116.8:7707
190.104.116.8:8808
190.104.116.8:62565
190.104.116.8:139
E2qgtjRHaRSi
-
delay
3
-
install
false
-
install_file
Java updater.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ftghrkopokpo.exe"C:\Users\Admin\AppData\Local\Temp\ftghrkopokpo.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB