Overview

overview

10

Static

static

1

document.ps1

windows7-x64

3

document.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5987d190c640cafc02bd5e0b7b023d7c793b25fc6af38ce7f541368683fc6b66

  • Size

    68KB

  • Sample

    241229-1xt63sxrhk

  • MD5

    59381e83e0f10a3b40cce6c623300bab

  • SHA1

    74cc3e19a08c6fa54089c8d71b35dce64c644f2d

  • SHA256

    5987d190c640cafc02bd5e0b7b023d7c793b25fc6af38ce7f541368683fc6b66

  • SHA512

    6847bbb9ecc22ebf6eab11ca231c079740e905a39f01919be564d12a6e7553678c5c4dd4c7a19ecf7e79004fb2ce6fea305169bb0c673790feddf194aca01e7f

  • SSDEEP

    1536:VGePQZPcWJE8V5MJugVgJUQBZmFqf9q/FJ+:cOWSqgVgJhQysP+

Score
10/10
asyncratbatdiscoveryexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

BAT

C2

mrv00100.publicvm.com:6666

Mutex

AsyncMutex_mrv00

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      document.PS1

    • Size

      237KB

    • MD5

      701750fca8e3b1a06e11c0e4971f7780

    • SHA1

      d5be6d794bca204eb189dfc2f38b98ef0dce6302

    • SHA256

      a20e52332a44c134f904d2ebcb779c46d397691ff5629812a6330774cad25b8d

    • SHA512

      87241bbe70c41c86cefe02e9b980be5b7c8ec6037af8edd94ea9f6628f39aafa801aa1bf3c8d512b603bebea724d8dae5c15af3760a18e8f23ebff8c5b56afce

    • SSDEEP

      3072:D2CD6RnNwZO2zD3N3AppqBMwIv1vZzd24Qzc:aCD6zGO2zD3N3Ap6Mg4Qzc

    Score
    10/10
    executionasyncratbatdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks