Overview

overview

10

Static

static

5

Drawing&spec.scr

windows7-x64

10

Drawing&spec.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99d8ecf3d2a1a59544148a8b2650e0fe4f4c76df2974d5d7df78de3f823c668b.img

  • Size

    1.5MB

  • Sample

    241206-dh2ahssqem

  • MD5

    92a54ab0fe5d27c735681582f2bac8a2

  • SHA1

    d8e9525dce6e2456da188d7102efc9ada81b28be

  • SHA256

    99d8ecf3d2a1a59544148a8b2650e0fe4f4c76df2974d5d7df78de3f823c668b

  • SHA512

    9f72acee8423480acab10fdba649ca1fdad58908a1141a73b1ce10568eff25ea67538d9594dd357d1eb9e198375a926ec5582be9aca35a1c7f9e6f1cf81bbfbe

  • SSDEEP

    24576:Yu6J33O0c+JY5UZ+XC0kGso6FauSnJzxWY:Su0c++OCvkGs9FauSaY

Score
10/10
asyncratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

69.174.100.131:6606

Mutex

abkZfsCYRZhk

Attributes
  • delay

    10

  • install

    false

  • install_file

    order.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Drawing&spec.scr

    • Size

      941KB

    • MD5

      3a43f4d6c1ce25bc8efe548fa2b16bc7

    • SHA1

      e0b8080d2c241ee9c8d7d31adb6ecc0fc43d0a0e

    • SHA256

      4b5cc1e99d28651fbb693422c5d392c5d47dfa61c8ec4995197706de5cb3442a

    • SHA512

      3613b2af89545273fb21c09889e02e477d86ac2e3f313fec2a28fb68c9e94b39b3160b26d7637dce1e5053808ffe14cb0aad9dd0c404bbd6d4c8d7ea897e8072

    • SSDEEP

      24576:uu6J33O0c+JY5UZ+XC0kGso6FauSnJzxWY:gu0c++OCvkGs9FauSaY

    Score
    10/10
    asyncratdefaultdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks