Overview

overview

10

Static

static

1

ad0ffe7312...31.exe

windows10-2004-x64

10

ad0ffe7312...31.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad0ffe731284de0fc2f0d61951a6431253dca0244868d3920d2139bc238d8231

  • Size

    570KB

  • Sample

    250421-yepgrswqy3

  • MD5

    6ab23d16f93e86b98dcfe307f267bfd5

  • SHA1

    a349276da5a1c5eef6f2b28e5326a4ad4b6f9c42

  • SHA256

    ad0ffe731284de0fc2f0d61951a6431253dca0244868d3920d2139bc238d8231

  • SHA512

    63d6b13a36002fdc4f67bda6abc6254d142f0df9bcd48bca8143c5eaa9934f9c084498b17dec826ba13a64e022264e95f7c296fa1d439a638a75eadc43fbe7be

  • SSDEEP

    12288:bRXtpnVH9Az44BnvOCDhzcl0UdKndi2bnXWuk:bfd8z4byilBdlGX

Score
10/10
asyncrattemmuz-29discoveryratupx

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Temmuz-29

C2

marsh3131.duckdns.org:1453

Mutex

cdskfdsk23refdS146Dfdm23

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ad0ffe731284de0fc2f0d61951a6431253dca0244868d3920d2139bc238d8231

    • Size

      570KB

    • MD5

      6ab23d16f93e86b98dcfe307f267bfd5

    • SHA1

      a349276da5a1c5eef6f2b28e5326a4ad4b6f9c42

    • SHA256

      ad0ffe731284de0fc2f0d61951a6431253dca0244868d3920d2139bc238d8231

    • SHA512

      63d6b13a36002fdc4f67bda6abc6254d142f0df9bcd48bca8143c5eaa9934f9c084498b17dec826ba13a64e022264e95f7c296fa1d439a638a75eadc43fbe7be

    • SSDEEP

      12288:bRXtpnVH9Az44BnvOCDhzcl0UdKndi2bnXWuk:bfd8z4byilBdlGX

    Score
    10/10
    asyncrattemmuz-29discoveryratupx

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Drops startup file

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks