General

  • Target

    036ebef5b4a2d221a1574365d87e989579227ce89abcc4ada44c373e3e50521d

  • Size

    45KB

  • Sample

    221205-t3vw8sbc2y

  • MD5

    5e586cec53a266bfe070814c16c1f1dd

  • SHA1

    5345359b9483f0ecc4e6fd163cd6d1514fa942a7

  • SHA256

    036ebef5b4a2d221a1574365d87e989579227ce89abcc4ada44c373e3e50521d

  • SHA512

    4e608875808b1be5e7cdfd29432b578fcb23bf57f5136999c2b8afe00bb47f4f59e8d1b1afd1e63cd77943a47ccea3e7f1157a564788ae77939f956f8865c9ff

  • SSDEEP

    768:7uPLZT9xSjiWUU32jmo2qrnKjGKG6PIyzjbFgX3iCklJp+F3awBDZLx:7uPLZT9kA2SKYDy3bCXSCaCamdLx

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:51115

127.0.0.1:26993

185.246.220.26:6606

185.246.220.26:7707

185.246.220.26:8808

185.246.220.26:51115

185.246.220.26:26993

5.tcp.ngrok.io:6606

5.tcp.ngrok.io:7707

5.tcp.ngrok.io:8808

5.tcp.ngrok.io:51115

5.tcp.ngrok.io:26993

disownnet.duckdns.org:6606

disownnet.duckdns.org:7707

disownnet.duckdns.org:8808

disownnet.duckdns.org:51115

disownnet.duckdns.org:26993

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      036ebef5b4a2d221a1574365d87e989579227ce89abcc4ada44c373e3e50521d

    • Size

      45KB

    • MD5

      5e586cec53a266bfe070814c16c1f1dd

    • SHA1

      5345359b9483f0ecc4e6fd163cd6d1514fa942a7

    • SHA256

      036ebef5b4a2d221a1574365d87e989579227ce89abcc4ada44c373e3e50521d

    • SHA512

      4e608875808b1be5e7cdfd29432b578fcb23bf57f5136999c2b8afe00bb47f4f59e8d1b1afd1e63cd77943a47ccea3e7f1157a564788ae77939f956f8865c9ff

    • SSDEEP

      768:7uPLZT9xSjiWUU32jmo2qrnKjGKG6PIyzjbFgX3iCklJp+F3awBDZLx:7uPLZT9kA2SKYDy3bCXSCaCamdLx

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Async RAT payload

MITRE ATT&CK Matrix

Tasks