General
-
Target
83a1b442bf9761f33881468eb8be300e18c5c12691eb52681efee2c4c5842a06.zip
-
Size
183KB
-
Sample
230321-rvqlfada61
-
MD5
11b2ed45087ecce842044dc62ad65ff1
-
SHA1
5c9cdbd072ac07d4bca0752d25b92ce1b55c5b9c
-
SHA256
cec5b4c31e4ec09930b5e1882600689aac68a30bc35c4963335f43bc6b09e893
-
SHA512
401aca16a669ba012632b870a07168f90e595920469327d9a082b160af21b7d63c77b0a66c38d4f7ffc5a6a746d13f26497fcc5282e00f44e8d376bb0060fd72
-
SSDEEP
3072:Uj9TyJQ4VLoPaKu8s3HhQc/VAfKFDWL/svqBTHOK0y8OsyH5R2McyNm8VG1Jq+qn:U4Q6o3CHhQctAfKFQa6T+5Oh5RdNm8VZ
Malware Config
Extracted
asyncrat
- By Dimas Rodrigues
2023
clsuplementos.ddns.net:1110
clsuplementos.ddns.net:2220
clsuplementos.ddns.net:3330
clsuplementos.ddns.net:4440
clsuplementos.ddns.net:5550
clsuplementos.ddns.net:6660
clsuplementos.ddns.net:7770
clsuplementos.ddns.net:8880
clsuplementos.ddns.net:9990
handling.ddns.net:1110
handling.ddns.net:2220
handling.ddns.net:3330
handling.ddns.net:4440
handling.ddns.net:5550
handling.ddns.net:6660
handling.ddns.net:7770
handling.ddns.net:8880
handling.ddns.net:9990
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
83a1b442bf9761f33881468eb8be300e18c5c12691eb52681efee2c4c5842a06.chm
-
Size
190KB
-
MD5
9d9a0a119044c6a83d533a1941bb64c5
-
SHA1
279387ccf49c5f71c99f8b89b333be4a70f6cab6
-
SHA256
83a1b442bf9761f33881468eb8be300e18c5c12691eb52681efee2c4c5842a06
-
SHA512
31c4edbcff416df4cada81dbd1e3bdc752cb8a74c837787feba01d9e93e00970b15efac6bf70548b8ba1811cf7e7522bbd64cfe0572d5619759b8069b5b399b2
-
SSDEEP
3072:Xg4C8YLEo5xuIvDocDWjc/pgDXQgKpacezvRBDobwrArHMp1G6/AirUIKX6MA:XpYIW0UY8pTxp/mjmqArYRQIKX5A
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext
-