Analysis
-
max time kernel
11s -
max time network
18s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
09-12-2024 16:04
General
-
Target
arf2.exe
-
Size
63KB
-
MD5
9e39db6ea47e815c623c2b2420a40e99
-
SHA1
a0e30ebc6b2ff9dd1e28fd32dc37cf736654d337
-
SHA256
87b9b0f3c4135a92ad332bc6e8ccacb65f6e5b2480ae312dcb1537869049e738
-
SHA512
e8cb49c175e6909f40c36e345e03ef1720018c85d3ca52074f031eb3ce469161d1025f86c52f56efd49aa08762d39666deeeb01a548fc1f57c1da5bbe629ee16
-
SSDEEP
768:1ktM6NqDuiP/tkiP9JqWk2xN+BZk1+fBCv7mqb2nMpwH1oKBCMHS9L8GTlZVc6KN:1kiDBlVDN6kQGbbHw9sM/GTlZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
Default
C2
roarwasd12312-34767.portmap.host:34767
Mutex
roaroaroaraoroaroaraoraoraoarororrohrorororoaroaaoaoaoaroaroar
Attributes
-
delay
1
-
install
false
-
install_file
windows defender firewall.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\arf2.exe"C:\Users\Admin\AppData\Local\Temp\arf2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB