Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11-01-2025 15:25
General
-
Target
79b29ed42190867bacb0d9afd29716f8a14dad9a7a1450f5b63097e48d9d7794.exe
-
Size
63KB
-
MD5
f8274be969e4ae100662a46357647e3b
-
SHA1
be64f6ecfbd81d732e07d6a99ec769af3b1313df
-
SHA256
79b29ed42190867bacb0d9afd29716f8a14dad9a7a1450f5b63097e48d9d7794
-
SHA512
bad05f49dddd759c3ad0bc5b1a10254642856a92bb7a936f055d5152efad81005d8ef278c546ccf5207bb64fecc3d06a38fa2b7d4373e4cb3cad2108c1cd921d
-
SSDEEP
768:Wm0vnfEXf78awC8A+XUemipEqO+pV91ZHw1+T4OSBGHmDbDiph0oX/g2XJ8YSuQ9:eEXi3mbyV9HQdYUbEh9NZiuQdpqKmY73
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
studies-gotta.gl.at.ply.gg:4323
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\79b29ed42190867bacb0d9afd29716f8a14dad9a7a1450f5b63097e48d9d7794.exe"C:\Users\Admin\AppData\Local\Temp\79b29ed42190867bacb0d9afd29716f8a14dad9a7a1450f5b63097e48d9d7794.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB