Overview

overview

10

Static

static

3

2026-01-08...ar.exe

windows10-2004-x64

10

2026-01-08...ar.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-01-08_0ba28e3de227c83663a1348a9be0e974_cobalt-strike_icedid_mespinoza_njrat_ryuk_stealc_vidar
  • Size 3.2MB
  • Sample260108-bn7ndabs4d
  • SHA256 68a21454cc9010525bc9c8d693ebf6b83b96ede0e46013f641516f9c3628d5ac
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratkr new v6 porndiscoveryexecutionrat

Malware Config

Extracted

Family

  • asyncrat

Version

  • AWS | 3Losh

Botnet

  • KR NEW V6 Porn

C2

  • trfvbhi.unrwpeifdot.info:8484

  • trfvbhi.unrwpeifdot.info:8585

  • trfvbhi.unrwpeifdot.info:8383

  • trfvbhi.unrwpeifdot.info:8282

  • trfvbhi.unrwpeifdot.info:8281

Mutex

  • AnikWAgry9433

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      2026-01-08_0ba28e3de227c83663a1348a9be0e974_cobalt-strike_icedid_mespinoza_njrat_ryuk_stealc_vidar
    • Size 3.2MB
    • SHA256 68a21454cc9010525bc9c8d693ebf6b83b96ede0e46013f641516f9c3628d5ac
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    kr new v6 porndiscoveryexecutionasyncratrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks