General

  • Target

    stub.exe

  • Size

    66KB

  • Sample

    230424-ws2cdafd5v

  • MD5

    82939ee2605a46e68018d5b075ef8e7a

  • SHA1

    6579b9eb62650df681b9ddc870d1012d23b85b09

  • SHA256

    fb11be4f9b79350a9b1e70ef3e835d0c066f15ea84424bc639e0fc70227d05a3

  • SHA512

    2eb55b7c6a92bae97c2399fc446ad0556e885290f9968d5405187d8c1bd6137db31c30cbfda8360206cb92246d0a50bd35f7585a2cd6d50a526ea40b335055d5

  • SSDEEP

    1536:v2UukvF1tkk/hEYRo2NQphePvUgcKu5UYF5KzUWudRj5sjsjObUu/+tfPQNnr/rR:v2JkvF1tkXKu5UYF5KzhuDj5sjIObUlE

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

mikedonohue.kozow.com:30305

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      stub.exe

    • Size

      66KB

    • MD5

      82939ee2605a46e68018d5b075ef8e7a

    • SHA1

      6579b9eb62650df681b9ddc870d1012d23b85b09

    • SHA256

      fb11be4f9b79350a9b1e70ef3e835d0c066f15ea84424bc639e0fc70227d05a3

    • SHA512

      2eb55b7c6a92bae97c2399fc446ad0556e885290f9968d5405187d8c1bd6137db31c30cbfda8360206cb92246d0a50bd35f7585a2cd6d50a526ea40b335055d5

    • SSDEEP

      1536:v2UukvF1tkk/hEYRo2NQphePvUgcKu5UYF5KzUWudRj5sjsjObUu/+tfPQNnr/rR:v2JkvF1tkXKu5UYF5KzhuDj5sjIObUlE

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v6

Tasks