asyncrat | 91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561

General

Target
118.exe
Size 423KB
Sample260904-nsffxawvbw
SHA256 91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561
MD5 0d60097c07241a4a98fb18196d21d75f
SHA1 32eb1eb04ffdce6012e24467778552999cf7f011
SHA512 27ca6f4c4f390acb6c9e2002f03cd20d7a4fb4fa0de2f79f2e26a977508f185da5888096da2ab784e78b420c0734c54a7a0f50201d69a09df16144d76601f916
SSDEEP 12288:DyWZpwVcYJYkYJ+UmoaQi2oAkpDZAUqYk9nhDXvU:DyWZpDiAxad2oAk36nBhDXvU
TLSH
T146942306FA31C57AE2B20174DDB56D3B4EBE8533866A3D43479074997E614C2D71F382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  118.exe
- Size 423KB
- SHA256 91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561
- MD5 0d60097c07241a4a98fb18196d21d75f
- SHA1 32eb1eb04ffdce6012e24467778552999cf7f011
- SHA512 27ca6f4c4f390acb6c9e2002f03cd20d7a4fb4fa0de2f79f2e26a977508f185da5888096da2ab784e78b420c0734c54a7a0f50201d69a09df16144d76601f916
- SSDEEP 12288:DyWZpwVcYJYkYJ+UmoaQi2oAkpDZAUqYk9nhDXvU:DyWZpDiAxad2oAk36nBhDXvU
- TLSH
  T146942306FA31C57AE2B20174DDB56D3B4EBE8533866A3D43479074997E614C2D71F382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution asyncrat donutloader loader persistence privilege_escalation rat
- Async RAT payload
  rat
- Detects DonutLoader
  loader
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  C:/Users/Public/Documents/11.exe
- Size 202KB
- SHA256 db413d7a7f36a922d30489d4df22d8fecd4da3a6e08f0a227ca770d6afa24bc3
- MD5 075d1d7228143a189f71ef74f4bcb6a5
- SHA1 44ae02db647ee02c3242467e87dd0cf8fe1de03d
- SHA512 85e5ab1652ac6517e3c90cc83ff4a6295c87423197b182d767f2847631a53c9e094641be8205251b17943c2d7ec4a33fa91ca226287937ecfa20f7b221c80173
- SSDEEP 3072:6ThKSbXiYQ41atgn29xocjz9+XtVXxMSmAxTeKamfIVjzc+v7hMDP98NYHeG:6VKSbXiYNUgn29xoy9mfIVc+v7huqU
- TLSH
  T17C14A25767E830C9F5B36A785AB142519B7ABCB26B34C7DF1194806E0F63BD09D30B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  C:/Users/Public/Documents/dbgeng.dll
- Size 452KB
- SHA256 53abcbd55948172502618a66218a7d68ea986106e084cd07bd4c9321d58689f7
- MD5 61b25e84079ba06aa146415cbbb49203
- SHA1 8064c75f805fb79789518be8202e1ec96d042617
- SHA512 acc03783acc5c9f74940d9fcdf5ad0e5ca3d568fd51cc9c522445454df9df1eb4b7dc7ee383ad28d673a131c5d85f26e0ea82c2cd8d7e248f801687c31b568de
- SSDEEP 6144:csvle2kMPBAZiJKgjknthlgyisJW0VxzNEyp2X3:csvhknVFisjVQ3
- TLSH
  T151A45B7432D090F5F09BD8344A1355C6E9667C9283F1EADB53D09E6A1F2B29C1AFB342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5