General

  • Target

    csrss.exe

  • Size

    48KB

  • Sample

    230314-q534vaff29

  • MD5

    36a18884c8e35fea7c2cf939e35bb56c

  • SHA1

    f212f55722ef7e4382bd5c59746ff60e26142c47

  • SHA256

    c1ad03476f5a2fe877b28c242eb68db4b0362e75dba1b595d458fce209dd5f28

  • SHA512

    47c2c5c36a0d8cba84af5834b839c96a1e742cd9e0d98772f03b37e02f665996b3f7949e49ed513213350cc5996b1ad10d0a8dc05d5bb9a4fe6ed98a057a22f6

  • SSDEEP

    768:0ujYC71TBEwp/WUTQy9mo2qzqSmHGHwVdgPIazQaWozr0bJLlDc76GoQjHb72cso:0u8A1TBvD2bSmF3FaMaBgbJLF3No6ti1

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    csrss.exe

  • install_folder

    %Temp%

  • pastebin_config

    https://pastebin.com/raw/3Z9zi18j

aes.plain

Targets

    • Target

      csrss.exe

    • Size

      48KB

    • MD5

      36a18884c8e35fea7c2cf939e35bb56c

    • SHA1

      f212f55722ef7e4382bd5c59746ff60e26142c47

    • SHA256

      c1ad03476f5a2fe877b28c242eb68db4b0362e75dba1b595d458fce209dd5f28

    • SHA512

      47c2c5c36a0d8cba84af5834b839c96a1e742cd9e0d98772f03b37e02f665996b3f7949e49ed513213350cc5996b1ad10d0a8dc05d5bb9a4fe6ed98a057a22f6

    • SSDEEP

      768:0ujYC71TBEwp/WUTQy9mo2qzqSmHGHwVdgPIazQaWozr0bJLlDc76GoQjHb72cso:0u8A1TBvD2bSmF3FaMaBgbJLF3No6ti1

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks