Overview

overview

10

Static

static

3

Api-Updater.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Api-Updater.exe

  • Size

    211KB

  • Sample

    241207-httr2axlcn

  • MD5

    c0094906b0e860b9df8aff26b335c308

  • SHA1

    45e1941e2e0bb66b3701be26a8652c84604bfb7d

  • SHA256

    71c71f532a866536e7adb19d12996c2d088d38377b53d5cce792b6d416fee4a1

  • SHA512

    2af5f9d5535488b30ca51a9d01f4ef765c0be33075f2b6312c740c60de2746347ab7a6fc12f39f4dfc1594879d08298f6a9ea7d57740fc1738f426c36b03f855

  • SSDEEP

    3072:xejqKOjH8TJ1P/4a+YKngaulnClmWVw1n3JDcv9ANoGCrI/dSEj7ObfREj8blPsg:xyOj234EFd3iLbmSy7OLREQblP

Score
10/10
asyncratexecutionpersistencerat

Malware Config

Targets

    • Target

      Api-Updater.exe

    • Size

      211KB

    • MD5

      c0094906b0e860b9df8aff26b335c308

    • SHA1

      45e1941e2e0bb66b3701be26a8652c84604bfb7d

    • SHA256

      71c71f532a866536e7adb19d12996c2d088d38377b53d5cce792b6d416fee4a1

    • SHA512

      2af5f9d5535488b30ca51a9d01f4ef765c0be33075f2b6312c740c60de2746347ab7a6fc12f39f4dfc1594879d08298f6a9ea7d57740fc1738f426c36b03f855

    • SSDEEP

      3072:xejqKOjH8TJ1P/4a+YKngaulnClmWVw1n3JDcv9ANoGCrI/dSEj7ObfREj8blPsg:xyOj234EFd3iLbmSy7OLREQblP

    Score
    10/10
    asyncratexecutionpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Async RAT payload

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks