General
- Target madium fix.exe
- Size 68.1MB
- Sample260620-ddqm8aes2t
- SHA256 4ea5319f91fa6d03b041e6dd520d9dd57cabd47478a676cb6be49755a34e6bd7
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
maz5rIHKJvqd
-
delay
3
-
install
false
-
install_folder
%AppData%
-
local_host
127.0.0.1
Targets
-
- Target madium fix.exe
- Size 68.1MB
- SHA256 4ea5319f91fa6d03b041e6dd520d9dd57cabd47478a676cb6be49755a34e6bd7
Score10/10-
Async RAT payload
-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DiscordUpdater.exe
- Size 172.5MB
- SHA256 8acb25487c6f9daa7da1bee38bac94c1bedc14d70b5ffff51d4010d8620d5e9a
Score10/10-
Async RAT payload
-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
- Target LICENSES.chromium.html
- Size 9.0MB
- SHA256 dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986
Score4/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
Score1/10 -
- Target ffmpeg.dll
- Size 2.6MB
- SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
Score1/10 -
- Target libEGL.dll
- Size 470KB
- SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
Score1/10 -
- Target libGLESv2.dll
- Size 7.7MB
- SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
Score1/10 -
- Target resources/app.asar
- Size 714KB
- SHA256 63dddc36802d01fb22be4363f1fcbaf3ca639c0bafa28911bc797a5421fba19e
Score3/10 -
- Target resources/app.asar.unpacked/build/Release/brazium_native.node
- Size 179KB
- SHA256 73551bb11309a13a3c80ae63cf592bec13a66236fb0ce27d08a2e0d4e41cb9bd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.2MB
- SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
Score1/10 -
- Target vulkan-1.dll
- Size 938KB
- SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3