Overview

overview

10

Static

static

1

123.txt

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    123.txt

  • Size

    178B

  • Sample

    241201-avfykavmgq

  • MD5

    f59cb95df607d6cc5547a698e079ddd3

  • SHA1

    5c327be38230b1bdece8264001c88c257a1d8087

  • SHA256

    c1ad7b461fde9e52ca6f2d2263f3f829940ced1538ffd7758e790faa129b3635

  • SHA512

    7284c78d69cd6f47a2451defadd4b7bffb17d75dbed1a43df0e780f9d740992751190548831806c830fa5c5ac88e39fbef3c404354a822ef46528e9a95f1c3e5

Score
10/10
asyncratniggerdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

nigger

C2

147.185.221.24:13562

Mutex

w6Aqn6QGMtjM

Attributes
  • delay

    3

  • install

    true

  • install_file

    msvisualstudio.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      123.txt

    • Size

      178B

    • MD5

      f59cb95df607d6cc5547a698e079ddd3

    • SHA1

      5c327be38230b1bdece8264001c88c257a1d8087

    • SHA256

      c1ad7b461fde9e52ca6f2d2263f3f829940ced1538ffd7758e790faa129b3635

    • SHA512

      7284c78d69cd6f47a2451defadd4b7bffb17d75dbed1a43df0e780f9d740992751190548831806c830fa5c5ac88e39fbef3c404354a822ef46528e9a95f1c3e5

    Score
    10/10
    asyncratniggerdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks