General

  • Target

    update.zip

  • Size

    2.4MB

  • Sample

    230501-f9k4qage2z

  • MD5

    c96277417b22b02300f8573a2ee5cddd

  • SHA1

    c3afa5ff29b260f4e8eea5f35e1ec39309bd5421

  • SHA256

    6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0

  • SHA512

    3de831ad79ddc2d122dde52f60cd7eac27b83cbf688f85b74d37eb3a636b98b3cf151b02bc107d50ba36be13fe455ac1a89e2fe0183e7be386673f9a7a90366f

  • SSDEEP

    12288:NTYV+u9dWbjVpGNGpKaj8qjhTcDxzV7jqlfhf6yz9OeNi:CVCfVeyjJhmNV6lFLz9OeNi

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

addimq.duckdns.org:7878

addimq.duckdns.org:9909

addimq.duckdns.org:6568

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      update.zip

    • Size

      2.4MB

    • MD5

      c96277417b22b02300f8573a2ee5cddd

    • SHA1

      c3afa5ff29b260f4e8eea5f35e1ec39309bd5421

    • SHA256

      6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0

    • SHA512

      3de831ad79ddc2d122dde52f60cd7eac27b83cbf688f85b74d37eb3a636b98b3cf151b02bc107d50ba36be13fe455ac1a89e2fe0183e7be386673f9a7a90366f

    • SSDEEP

      12288:NTYV+u9dWbjVpGNGpKaj8qjhTcDxzV7jqlfhf6yz9OeNi:CVCfVeyjJhmNV6lFLz9OeNi

    Score
    1/10
    • Target

      update.exe

    • Size

      1024.0MB

    • MD5

      266a9e038cfb90db7fa5d45282dac72d

    • SHA1

      6bf5ebe90c764e7d82c6c8e75c2ce3418dd923e0

    • SHA256

      4f67eda04defdf40355ab17ff4d72f0270f6265ad39f918ecab8a11727832e22

    • SHA512

      1358982cb90e763c88338c1a90c24e2b46ea7f521e4023a9a02ef5d9d1b802035808d9d055e9c0f297f33d7c099fd4e8b6fe1b5be9e0d38919a680262f8227ae

    • SSDEEP

      12288:84mT/RcXtvyJdBQhXVQpPDv4aloZqby13caYgd2DBAm:84C/6XtvWBmQpPTXgcaYgdCA

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v6

Tasks