Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
15/04/2025, 16:00
General
-
Target
file.exe
-
Size
45KB
-
MD5
73b24e046f0348e3ffc30398a8306a51
-
SHA1
1d058188b3e194107fcde90e9c3a7762561bedd4
-
SHA256
e031d5b9b47ac7d1ceabde5e77aa9555b7ca4603bf5f3195731922a677bf391b
-
SHA512
19bb17f7a16e9ee799ff6523865da37aa474f2372b4ef0242dd4e7e0c7e71d7e96596758c6f9ef1cf925692263386e27345cec2d9a3bc383f4f1757e2ed6c3b5
-
SSDEEP
768:puPfZTg4pYiWUU9jjmo2qrqAPB+luOJPISzjbWgX3iZ19p9UT7BDZ6x:puPfZTgKa21+UuOmS3bJXSZ19petd6x
Malware Config
Extracted
asyncrat
0.5.8
Default
cryptoghost.zapto.org:2000
Dm4vMelJMBBG
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
latentbot
cryptoghost.zapto.org
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Latentbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB