General

  • Target

    Erodo.exe

  • Size

    342KB

  • Sample

    220404-dxs8fsheg9

  • MD5

    0d0d64eecf0771dfc73ea6674802c256

  • SHA1

    a9eb93937399030d52ce1641794b0fab1c398724

  • SHA256

    f927fc3dee7de6daefed3b155907078344fbfec8bd3d63ed96013c2c9ae1e78e

  • SHA512

    d424f4ad1298e483d7707d8e8feb5a9bd836830923b487c574b0d1e8cccf3840182e35765220c464e3310caed7c409594af1c2a604302f90d631664ff0765cd1

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

2

C2

212.193.30.54:9524

Mutex

wyQ92!.,=FT72few

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Erodo.exe

    • Size

      342KB

    • MD5

      0d0d64eecf0771dfc73ea6674802c256

    • SHA1

      a9eb93937399030d52ce1641794b0fab1c398724

    • SHA256

      f927fc3dee7de6daefed3b155907078344fbfec8bd3d63ed96013c2c9ae1e78e

    • SHA512

      d424f4ad1298e483d7707d8e8feb5a9bd836830923b487c574b0d1e8cccf3840182e35765220c464e3310caed7c409594af1c2a604302f90d631664ff0765cd1

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks