Overview

overview

10

Static

static

1

ORDER#2504...pdf.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1de23c3bc20fc709cedde358b0782aec3373291a758f41ce5baebd8ede500a84

  • Size

    96KB

  • Sample

    250402-x2wc6assfs

  • MD5

    cb07c8bbf77000bd858f0030543e69f6

  • SHA1

    3ee3f11cca0308ef0e6b85b00285ca550fc0a474

  • SHA256

    1de23c3bc20fc709cedde358b0782aec3373291a758f41ce5baebd8ede500a84

  • SHA512

    02aee888909abc8b48420e05186b55ade955641b903ac5c56ac46a666df597d1d1bc55a8ea67a4005dfaca02cb27bc0abdae983aff7a5c5508e1d252aa3a0761

  • SSDEEP

    3072:CHj0mAXqrXZ/kGLbvw7vUrJ+OtMKJIFCMDGmgu1G:CHjYqRLULG+OuxFCMCmh1G

Score
10/10
asyncratwshratapr-25-2discoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

APR-25-2

C2

chongmei33.publicvm.com:2703

chongmei33.publicvm.com:7031

umarmira055.duckdns.org:2703

umarmira055.duckdns.org:7031
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

wshrat

C2

http://chongmei33.myddns.rocks:7044

Targets

    • Target

      ORDER#250401-789057.pdf.js

    • Size

      564KB

    • MD5

      169562960a4143f84791abdff608d54d

    • SHA1

      60170c23389a9b995bcec617ceee5ce055157859

    • SHA256

      0a2b59698651ff2b7b94bc9b41fd04482eb5a2e78242227caf3c59c7ce21284b

    • SHA512

      05151182885b7175993fb80eb7f688a89586db58ad7835edbbaa82585ecce29dd427a842b02a074921c2023e93f1e4f91132f6f9e160f995a2c9f778de32bd4b

    • SSDEEP

      3072:AN/053WsFOT+2WoBZ6t0DXm4yLWVPmtxL87ODaqwB:AN/c3FFOTFF6ShLIOB

    Score
    10/10
    asyncratwshratapr-25-2discoveryexecutionpersistencerattrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

      trojanwshrat

    • Wshrat family

      wshrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks