Overview

overview

10

Static

static

10

bundy.exe

windows7-x64

10

bundy.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bundy.exe

  • Size

    45KB

  • Sample

    241117-hg5c1axrcq

  • MD5

    7f6f0f84c1ebc50ef5b07b400e3055b9

  • SHA1

    ff1d521cd7e28db6a80fcb6a0937eab2efba8292

  • SHA256

    ba4e656f1e01be59a74dd10864d9bc50d9add5647c2d860a6d1ad183008a39fb

  • SHA512

    ba65999a790f0c76e315e023e69a1d748187ce1f7b4a68ab34618df97265dc5b16663251dcec14b6ee5bcb825094fba8049c088f9ae150edaf8fa62bf6c7fdfb

  • SSDEEP

    768:Fuu11TwQsOnFWUFN1/mo2qD60YFK8oubbbQtTk/nPIAdzjbigX3iyX72osKkPNDo:Fuu11TwSb22YnctTiAAd3bFXSS72osKP

Score
10/10
asyncratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:1604
Mutex

76neALhoLeyJ

Attributes
  • delay

    3

  • install

    true

  • install_file

    bundy.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      bundy.exe

    • Size

      45KB

    • MD5

      7f6f0f84c1ebc50ef5b07b400e3055b9

    • SHA1

      ff1d521cd7e28db6a80fcb6a0937eab2efba8292

    • SHA256

      ba4e656f1e01be59a74dd10864d9bc50d9add5647c2d860a6d1ad183008a39fb

    • SHA512

      ba65999a790f0c76e315e023e69a1d748187ce1f7b4a68ab34618df97265dc5b16663251dcec14b6ee5bcb825094fba8049c088f9ae150edaf8fa62bf6c7fdfb

    • SSDEEP

      768:Fuu11TwQsOnFWUFN1/mo2qD60YFK8oubbbQtTk/nPIAdzjbigX3iyX72osKkPNDo:Fuu11TwSb22YnctTiAAd3bFXSS72osKP

    Score
    10/10
    asyncratdefaultdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks