asyncrat | hxxps://docs[.]google[.]com/uc?export=download&id=1JLDIqPBwfFqOwOAI9gBaNliRmZFmgPGx | Triage

Sharing

General

Target

https://docs.google.com/uc?export=download&id=1JLDIqPBwfFqOwOAI9gBaNliRmZFmgPGx
Sample

241120-2f2p9svlg1

Score

10^/10

asyncrat z-oct-16 android discovery persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Z-Oct-16

C2

pt4040.4cloud.click:4004

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  
  https://docs.google.com/uc?export=download&id=1JLDIqPBwfFqOwOAI9gBaNliRmZFmgPGx
Score

10^/10

asyncrat z-oct-16 discovery persistence rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Asyncrat family
  asyncrat
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

urlscan1

behavioral1

asyncratz-oct-16discoverypersistencerat

behavioral2