Overview

overview

10

Static

static

1

dd3893426b...01.ps1

windows7-x64

3

dd3893426b...01.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd3893426bcfecb6cabe3419b30d250731c4a81324b2adfe64d3d0f912eef301.ps1

  • Size

    6KB

  • Sample

    241205-d12n1awpgv

  • MD5

    45f9661bb41a7c25b211f4e71ecdef09

  • SHA1

    0cedd0635e20e7b61b0c507962d290db8c00d942

  • SHA256

    dd3893426bcfecb6cabe3419b30d250731c4a81324b2adfe64d3d0f912eef301

  • SHA512

    604a262ef96774b182455009119a87a85bdc5ec8d4ae656bc1e35b5de601bf840f786b7e070dffc02c88ed538095bbe49040af63cd1bdf6ccb69877111aa521e

  • SSDEEP

    192:fF89UppmWcYXg4Uvmky5CzdCyusCjTf0p8:fF8SppmWtevmkkedCyhuAW

Score
10/10
asyncratdozzy[1]discoveryexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Dozzy[1]

Mutex

Setup_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/AJqrj5ZH

aes.plain

Targets

    • Target

      dd3893426bcfecb6cabe3419b30d250731c4a81324b2adfe64d3d0f912eef301.ps1

    • Size

      6KB

    • MD5

      45f9661bb41a7c25b211f4e71ecdef09

    • SHA1

      0cedd0635e20e7b61b0c507962d290db8c00d942

    • SHA256

      dd3893426bcfecb6cabe3419b30d250731c4a81324b2adfe64d3d0f912eef301

    • SHA512

      604a262ef96774b182455009119a87a85bdc5ec8d4ae656bc1e35b5de601bf840f786b7e070dffc02c88ed538095bbe49040af63cd1bdf6ccb69877111aa521e

    • SSDEEP

      192:fF89UppmWcYXg4Uvmky5CzdCyusCjTf0p8:fF8SppmWtevmkkedCyhuAW

    Score
    10/10
    executionasyncratdozzy[1]discoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks