Overview

overview

10

Static

static

10

ratware/injector.exe

windows11-21h2-x64

10

ratware/launcher.vbs

windows11-21h2-x64

10

ratware/settings.bat

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ratware (2).zip
  • Size 23KB
  • Sample260718-1b7kaaf13z
  • SHA256 b5a62c25d14ad984e86fb1e458311a13cfb867cfaf5b31904f4c10304efc743a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
asyncratdefaultdefense_evasiondiscoveryexecutionpersistencerat

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • Default

C2

  • 209.25.141.25:1312

Mutex

  • mU3Wzt3B211d

Attributes
  • delay

    3

  • install

    true

  • install_file

    RobloxUpdate.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      ratware/injector.dll
    • Size 45KB
    • SHA256 8de517a3447c7dc4a8944180394b36f9fe01cd823eb9f5a4f6a110398761539c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defaultdefense_evasiondiscoveryexecutionasyncratpersistencerat

    • Async RAT payload

      rat

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Executes dropped EXE

    behavioral1
    • Target
      ratware/launcher.vbs
    • Size 58B
    • SHA256 799e318815354252d4e46997c5bfb0686aa0f4011c700ec1442643154ef0795a
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    defaultdiscoveryexecutionasyncratrat

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral2
    • Target
      ratware/settings.bat
    • Size 1KB
    • SHA256 05f667da8c93c5aedc67390329091ca59ae32af466a54dd0c6781123ddb36588
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    defaultdiscoveryexecutionasyncratpersistencerat

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat
    behavioral3

MITRE ATT&CK Enterprise v16

Tasks