Overview

overview

10

Static

static

3

shl-t2rf-a...in.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    shl-t2rf-as.py.deob.py.bin.exe

  • Size

    352KB

  • Sample

    250227-r1rqpa1ky8

  • MD5

    98de174aa68f9fcb356262ccdd548861

  • SHA1

    ddc3fe9a0bce70a0ca68eec3bd131c78f922a052

  • SHA256

    c2c026e601046e29c2ddc4d6608e562a3ab33c869983125ff1faba3e4a46b66c

  • SHA512

    369d2723a947a8c163fcccf102ef262dc2237122e291f4f8b74e7a5bc0c11ee8d9615c23cd550b43ec59c254ae58c69680eb41533159b69ea52d2d7f577bdc3d

  • SSDEEP

    6144:FFg+5AWj7+B7YqnqbopO6luag+ShMH9O1BNINgKXAsC:Fi+5AWjy7YGXplEDMo7IGKXAV

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

ashleyasync.duckdns.org:8797

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      shl-t2rf-as.py.deob.py.bin.exe

    • Size

      352KB

    • MD5

      98de174aa68f9fcb356262ccdd548861

    • SHA1

      ddc3fe9a0bce70a0ca68eec3bd131c78f922a052

    • SHA256

      c2c026e601046e29c2ddc4d6608e562a3ab33c869983125ff1faba3e4a46b66c

    • SHA512

      369d2723a947a8c163fcccf102ef262dc2237122e291f4f8b74e7a5bc0c11ee8d9615c23cd550b43ec59c254ae58c69680eb41533159b69ea52d2d7f577bdc3d

    • SSDEEP

      6144:FFg+5AWj7+B7YqnqbopO6luag+ShMH9O1BNINgKXAsC:Fi+5AWjy7YGXplEDMo7IGKXAV

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Async RAT payload

      rat
    behavioral1

MITRE ATT&CK Matrix

Tasks