Analysis
-
max time kernel
134s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
15/04/2025, 16:00
General
-
Target
file.exe
-
Size
45KB
-
MD5
d93b7b6fe46a1c6168c2b11ef711eb82
-
SHA1
b114d91e35b8ebc9709fe4df64153df271dd3602
-
SHA256
6b53024a6bcb610eca943feea6587847eeaab18945fd8667941266d5de852445
-
SHA512
fbd77d12665aec3c3b1697da5328d234c88b9876c9eea37c6cefa1163cecd06d7f9859233f3e409e14e4b212a8b9def7e6ae98d4d8d52414524b4b75a88c48ea
-
SSDEEP
768:yuPfZTg4pYiWUU9jjmo2qrYKjPGaG6PIyzjbFgX3iaL5OKa+ly0Io0qBDZqx:yuPfZTgKa2BKTkDy3bCXSaLsAln00dqx
Malware Config
Extracted
asyncrat
0.5.8
Default
cryptoghost.zapto.org:2000
Dm4vMelJMBBG
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
latentbot
cryptoghost.zapto.org
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Latentbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB