Analysis
-
max time kernel
56s -
max time network
59s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30/03/2025, 19:08
General
-
Target
08730f7d7aeabfb25d1abfbe7d506788eb86ef7a8684ebfdc7ed30ffc7e8d400.exe
-
Size
178KB
-
MD5
a3214b4da8f5acf7794183de63d45c8a
-
SHA1
c8c0524e375153a3f111c86be578d88f0be1ec2e
-
SHA256
08730f7d7aeabfb25d1abfbe7d506788eb86ef7a8684ebfdc7ed30ffc7e8d400
-
SHA512
4271d589258d745982d3aca01713d3de48b48c40f595adb9d31ddf4fc36590990eba874b9c6ba5b24ec1040aceb1f550fea8b5e81483ce2ea464db9738312d05
-
SSDEEP
3072:MDKW1LgppLRHMY0TBfJvjcTp5XNN90a2yyFzipzBKYhxy:MDKW1Lgbdl0TBBvjc/l0a2yyFmpB/y
Malware Config
Extracted
asyncrat
| Edit by Vinom Rat
Default
185.208.158.47:6606
185.208.158.47:7707
185.208.158.47:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\08730f7d7aeabfb25d1abfbe7d506788eb86ef7a8684ebfdc7ed30ffc7e8d400.exe"C:\Users\Admin\AppData\Local\Temp\08730f7d7aeabfb25d1abfbe7d506788eb86ef7a8684ebfdc7ed30ffc7e8d400.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB