General

  • Target

    file.exe

  • Size

    171KB

  • Sample

    230613-rnfgwsge95

  • MD5

    7c44e8e46e3f7669ad24db6756895950

  • SHA1

    ad74d9dbca6885a004e21824d87f8e5168030484

  • SHA256

    d447242a078661aa69c652929cbedbc1896b135aa50ed27427ea8c7e4d4a71be

  • SHA512

    97b96bb2d5b07b13aae9768867b040ea67b8cc5bfcbfe15f61fe71809609d3d6c6fa867efec91cd1431d27affae8380bd514788cf5b235142bb8c095458c06fd

  • SSDEEP

    3072:FWAm7g0RE3N82rmAniiFhb7zPeo7f8D6L6W6/68696Ugtdy+PkDLJ6rSIalbn:sHE3i2rmVizt8D6L6W6/68696UgtPkDd

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

192.168.175.1:1800

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      file.exe

    • Size

      171KB

    • MD5

      7c44e8e46e3f7669ad24db6756895950

    • SHA1

      ad74d9dbca6885a004e21824d87f8e5168030484

    • SHA256

      d447242a078661aa69c652929cbedbc1896b135aa50ed27427ea8c7e4d4a71be

    • SHA512

      97b96bb2d5b07b13aae9768867b040ea67b8cc5bfcbfe15f61fe71809609d3d6c6fa867efec91cd1431d27affae8380bd514788cf5b235142bb8c095458c06fd

    • SSDEEP

      3072:FWAm7g0RE3N82rmAniiFhb7zPeo7f8D6L6W6/68696Ugtdy+PkDLJ6rSIalbn:sHE3i2rmVizt8D6L6W6/68696UgtPkDd

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks