Overview

overview

10

Static

static

10

spooferexe.exe

windows7-x64

10

spooferexe.exe

windows10-2004-x64

10

Resubmissions

07-07-2024 10:40

240707-mqm8assdnf 10

27-06-2024 13:34

240627-qt4agawdmp 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    spooferexe.exe

  • Size

    63KB

  • Sample

    240707-mqm8assdnf

  • MD5

    4f3d74ad18bafdc2aaa94ea2d2bf9423

  • SHA1

    2ccd26c6760ca04d9ca8b3761b2e9b54485450bf

  • SHA256

    8f9b5a425ca5c012a26fa47754f9f2f102a90430033623e310ca18f10e8bb502

  • SHA512

    0025953e7b173bb038726cd1ca3147a9a412decd8cd9991f1414560b837c0b6a0faf97078e640e872d8e1de23a040437a1d6c4bd4ab0aa359ff7cfb81e6df647

  • SSDEEP

    1536:7RRQPpJrZ5wvBy10w8qYUbDh9KTMNrugdpqKmY7:7AYJiYUbDuqhGz

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

0.tcp.eu.ngrok.io:13147

Attributes
  • delay

    1

  • install

    true

  • install_file

    spoofer.exe

  • install_folder

    %Temp%

aes.plain

Targets

    • Target

      spooferexe.exe

    • Size

      63KB

    • MD5

      4f3d74ad18bafdc2aaa94ea2d2bf9423

    • SHA1

      2ccd26c6760ca04d9ca8b3761b2e9b54485450bf

    • SHA256

      8f9b5a425ca5c012a26fa47754f9f2f102a90430033623e310ca18f10e8bb502

    • SHA512

      0025953e7b173bb038726cd1ca3147a9a412decd8cd9991f1414560b837c0b6a0faf97078e640e872d8e1de23a040437a1d6c4bd4ab0aa359ff7cfb81e6df647

    • SSDEEP

      1536:7RRQPpJrZ5wvBy10w8qYUbDh9KTMNrugdpqKmY7:7AYJiYUbDuqhGz

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks