General
-
Target
RG.chm
-
Size
190KB
-
Sample
230321-mrnv8abg9w
-
MD5
9d9a0a119044c6a83d533a1941bb64c5
-
SHA1
279387ccf49c5f71c99f8b89b333be4a70f6cab6
-
SHA256
83a1b442bf9761f33881468eb8be300e18c5c12691eb52681efee2c4c5842a06
-
SHA512
31c4edbcff416df4cada81dbd1e3bdc752cb8a74c837787feba01d9e93e00970b15efac6bf70548b8ba1811cf7e7522bbd64cfe0572d5619759b8069b5b399b2
-
SSDEEP
3072:Xg4C8YLEo5xuIvDocDWjc/pgDXQgKpacezvRBDobwrArHMp1G6/AirUIKX6MA:XpYIW0UY8pTxp/mjmqArYRQIKX5A
Malware Config
Extracted
asyncrat
- By Dimas Rodrigues
2023
clsuplementos.ddns.net:1110
clsuplementos.ddns.net:2220
clsuplementos.ddns.net:3330
clsuplementos.ddns.net:4440
clsuplementos.ddns.net:5550
clsuplementos.ddns.net:6660
clsuplementos.ddns.net:7770
clsuplementos.ddns.net:8880
clsuplementos.ddns.net:9990
handling.ddns.net:1110
handling.ddns.net:2220
handling.ddns.net:3330
handling.ddns.net:4440
handling.ddns.net:5550
handling.ddns.net:6660
handling.ddns.net:7770
handling.ddns.net:8880
handling.ddns.net:9990
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
RG.chm
-
Size
190KB
-
MD5
9d9a0a119044c6a83d533a1941bb64c5
-
SHA1
279387ccf49c5f71c99f8b89b333be4a70f6cab6
-
SHA256
83a1b442bf9761f33881468eb8be300e18c5c12691eb52681efee2c4c5842a06
-
SHA512
31c4edbcff416df4cada81dbd1e3bdc752cb8a74c837787feba01d9e93e00970b15efac6bf70548b8ba1811cf7e7522bbd64cfe0572d5619759b8069b5b399b2
-
SSDEEP
3072:Xg4C8YLEo5xuIvDocDWjc/pgDXQgKpacezvRBDobwrArHMp1G6/AirUIKX6MA:XpYIW0UY8pTxp/mjmqArYRQIKX5A
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-