Overview

overview

10

Static

static

10

Discord.exe

windows7-x64

10

Discord.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4fcbfbd8040986b39b1d7661adf8cc6451c24aa4b607b9212793f77526ce79af

  • Size

    25KB

  • Sample

    241223-rjf8ma1rep

  • MD5

    0363bce8768e897a24897a6cfe587802

  • SHA1

    f1ddf91c4879b6c55267952d3d9b53244aebbb93

  • SHA256

    4fcbfbd8040986b39b1d7661adf8cc6451c24aa4b607b9212793f77526ce79af

  • SHA512

    8d04cb62db6241a656d4c833a7ef4ff16bbf1b65b8e7bd63984079ea57e3f74b9b9eebced078aa8d8620c8b1231f0c196d26de9d8a592b51941c297c46bbe8a7

  • SSDEEP

    768:ShHKRckOrlo29Ip8qONaRfmPBjX6J5Bbv9OV7Jc:ShqRc/y2mCqHwjZV7q

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

185.65.134.165:55160

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Discord.bin

    • Size

      71KB

    • MD5

      045c870906097c7aa54d257382471115

    • SHA1

      bea629242fb4facf3fd1de1f86ce3e2811777520

    • SHA256

      025ce30902b4a9cade0381c523ac27d67c0598743ba2675e7efd3669ec8ff141

    • SHA512

      cf89a37c99c52db276233c0371952c5595448299f7d3d0372f456f5c1dbe3037a2e14d61ef98685739fb71f728879169247afcc9e1da549d31b5bb52407c785c

    • SSDEEP

      768:gucNE9IL2C6y+DiPdPiBLVisiW0zUYbhge7tkeGqm77rvEgK/Jrpp6uB3+Vc6KN:Ncy2RCUe0zbbOzeGqCnkJrpp66+VclN

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks