Analysis
-
max time kernel
94s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-11-2024 08:49
General
-
Target
0b364ebb65271976f0bb21040c895741a2cc8f88646a5b244661fbe24dff26a9N.exe
-
Size
47KB
-
MD5
b0981dacf46c58799967c197fded8170
-
SHA1
1bf6ce5c8c04bfeae1365b900aa9122f571535dc
-
SHA256
0b364ebb65271976f0bb21040c895741a2cc8f88646a5b244661fbe24dff26a9
-
SHA512
164be33baeb68d133a9a3e8687eea0aec8b3f99ba2c3e31be1063a75618057eaa3e4d0a9e5a8cea2dd16915567d972afa5dada49700865fa9aed5082490efdf6
-
SSDEEP
768:12IOqAILNCyh+Di5Gyivx8YbngKLoW1cvEgK/J7ZVc6KN:12CN5Qzbg4Z1cnkJ7ZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
LUX0RTHEBEST
C2
avup32.zapto.org:3236
Mutex
asasasasasa
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b364ebb65271976f0bb21040c895741a2cc8f88646a5b244661fbe24dff26a9N.exe"C:\Users\Admin\AppData\Local\Temp\0b364ebb65271976f0bb21040c895741a2cc8f88646a5b244661fbe24dff26a9N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
1.0MB