Overview

overview

10

Static

static

10

soundpad.exe

windows7-x64

10

soundpad.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    soundpad.exe

  • Size

    110KB

  • Sample

    241223-s6kd8stnak

  • MD5

    3870690adc7c168e285a3c9b2c2b572a

  • SHA1

    eeb416a6b4f9d052544f6845a5ec93ad063e2ba1

  • SHA256

    cade54e2c8a16ec81171dcfd14e63d66cb81502625488b995197abd96e497058

  • SHA512

    7aeebbea95f51cffb28d929d1f620a73873b96f3c3ece7448a50fed51f0fecff31e61b41b5e9ced58a9998eda83a30f08e1c0cd440b7eeb4c488e4b36bdc3df0

  • SSDEEP

    1536:vKLmTn93wcPNoUb9h9eF3G0ZDurhWDlJY47qRIZU3upBn52158pqKmY7:vTL93toUb9KF3GIGAY4+CZU3k5215Xz

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

Attributes
  • delay

    1

  • install

    true

  • install_file

    update.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/piJ4a3wb

aes.plain

Targets

    • Target

      soundpad.exe

    • Size

      110KB

    • MD5

      3870690adc7c168e285a3c9b2c2b572a

    • SHA1

      eeb416a6b4f9d052544f6845a5ec93ad063e2ba1

    • SHA256

      cade54e2c8a16ec81171dcfd14e63d66cb81502625488b995197abd96e497058

    • SHA512

      7aeebbea95f51cffb28d929d1f620a73873b96f3c3ece7448a50fed51f0fecff31e61b41b5e9ced58a9998eda83a30f08e1c0cd440b7eeb4c488e4b36bdc3df0

    • SSDEEP

      1536:vKLmTn93wcPNoUb9h9eF3G0ZDurhWDlJY47qRIZU3upBn52158pqKmY7:vTL93toUb9KF3GIGAY4+CZU3k5215Xz

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks