Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
30/01/2025, 18:32
General
-
Target
Client.exe
-
Size
47KB
-
MD5
57473532df9f36a28a448ee34f4f7fd3
-
SHA1
316e00632305a48730ca5cc79fa1b82262d53ddf
-
SHA256
f5044936f0ad796b879fd0a0dbfb4d5bf09208b49dfabd028a129982bdf397eb
-
SHA512
8ef6ad8bc599a1646b6b45cc3cfc7ce812986b8f1e1c030f01f0f58f52350650f3ac97df58234cce165f9b5035bbf0161ddf10389e4b093984a0cedfa2c0ced0
-
SSDEEP
768:8oGDMmILyCe++bittelDSN+iV08YbygeAgQovEgK/JjZVc6KN:8o0MWSttKDs4zb1XXonkJjZVclN
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Mutex
atqrqvplsfah
Attributes
-
delay
1
-
install
false
-
install_file
winws.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/cn4rM5C9
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 23 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB