Overview

overview

10

Static

static

3

2de214ec47...cs.exe

windows7-x64

10

2de214ec47...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe

  • Size

    88KB

  • Sample

    240701-cnm5eawfnm

  • MD5

    ab0dda5cd7272c32d5f23f0b1c1ff990

  • SHA1

    f686df6059a503d408ace8d71942179c564175e0

  • SHA256

    2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7

  • SHA512

    69f89485d1d914ad66450697185cc7342db53d9c80f066b94bf2d24a41854023a58fffb5c597a44498de8d44a549ef1b4490945b141aebfa4b4c1d556eef1ffc

  • SSDEEP

    1536:5CCwU2APx7AZ8dQXdfC7LsxFBPIDEBnjFbzMqseUFEt+4MzOBk4NBf9EZ+:5CCF62QXda3C7gDyjpzMkBBk4NBf96

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:1337

Mutex

pifwaysdoflx

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe

    • Size

      88KB

    • MD5

      ab0dda5cd7272c32d5f23f0b1c1ff990

    • SHA1

      f686df6059a503d408ace8d71942179c564175e0

    • SHA256

      2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7

    • SHA512

      69f89485d1d914ad66450697185cc7342db53d9c80f066b94bf2d24a41854023a58fffb5c597a44498de8d44a549ef1b4490945b141aebfa4b4c1d556eef1ffc

    • SSDEEP

      1536:5CCwU2APx7AZ8dQXdfC7LsxFBPIDEBnjFbzMqseUFEt+4MzOBk4NBf9EZ+:5CCF62QXda3C7gDyjpzMkBBk4NBf96

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks