Overview

overview

10

Static

static

1

asyncnovodisparo.ps1

windows7-x64

3

asyncnovodisparo.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_73f11b98e491b88396355938c27d22a77149a2d86cb2d6123da1f272ca47824d

  • Size

    36KB

  • Sample

    241222-df5j6a1jgy

  • MD5

    bc6ed0f82b65ef00cb7741ade0972045

  • SHA1

    0447ebd1567e35b227d62f939cab3ad7acfd5ff1

  • SHA256

    73f11b98e491b88396355938c27d22a77149a2d86cb2d6123da1f272ca47824d

  • SHA512

    0ff4f77072c66b51df2179da531eef0b9c7eee4970d857e24ad47c9f96c2503cfd07553095397b5193f484bd7688c6a082dcf21df46cbc26a558c732e1eb61e8

  • SSDEEP

    768:b8TxevFuuf4VozcH44rKEijNy/G++IKt2NwRG4DwXhO7G:b8cv7qoYYyKEijNy/G++D2WRG48hO7G

Score
10/10
asyncrata_(_c.d.t_)_adiscoveryexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

A_(_C.D.T_)_A

C2

chromedata.accesscam.org:6606

chromedata.accesscam.org:7707

chromedata.accesscam.org:8808

chromedata.accesscam.org:4404

chromedata.accesscam.org:5505

chromedata.accesscam.org:3303

chromedata.accesscam.org:2222

chromedata.accesscam.org:5155

chromedata.accesscam.org:5122

chromedata.accesscam.org:9000

chromedata.accesscam.org:9999

chromedata.accesscam.org:8888

cdt.3utilities.com:6606

cdt.3utilities.com:7707

cdt.3utilities.com:8808

cdt.3utilities.com:4404

cdt.3utilities.com:5505

cdt.3utilities.com:3303

cdt.3utilities.com:2222

cdt.3utilities.com:5155
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      asyncnovodisparo.ps1

    • Size

      143KB

    • MD5

      22349ef6db03e6edef6f007e79641351

    • SHA1

      c03776ce09df11b0a94e125497d77f565b430fd6

    • SHA256

      e170dce58acff291b1ee9cde4093d13ade6a32067b980dbd33033228cc377472

    • SHA512

      563e869b3e98363a705173c4a70e2f46b737ebe56a649c24411c2a733968a40ad1037b4d4d391a6a7e872ac61979dd5912b87bd362dfcb37da116dd483e252c5

    • SSDEEP

      1536:eHOcX1zil9bKkGIANVSSHucBDq2Ehlmx9oTizyrxzNmPKShfes/bAXEXSlQZnjKI:ehMlyNGwuubDzDNSMoW3ApnvV3vCOC5

    Score
    10/10
    executionasyncrata_(_c.d.t_)_adiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks