General

  • Target

    xPo8U6ZjwEaV.exe

  • Size

    47KB

  • Sample

    230614-znsq8adg81

  • MD5

    1d04efd3c005feba5161fd2ddd8d7194

  • SHA1

    da4d6966afc58bd5b4f0e76b3af422f1b0235fce

  • SHA256

    aa44b193e2eb0046c55dc1a78fed298c361f06835256504ff42db39c5692df10

  • SHA512

    21d82980eb1a51e8cafe6062b2f51636c3dece8a1a67a1b9c22eb9311c39b02931162aea19269c864c638211421614116cd9db7790fc1621d5d1ecb3e4bae774

  • SSDEEP

    768:V9umxLiIL1CaS+DiNzTlD0yO5iBBYbugeVFybEvEgK/JzZVc6KN:V9uAPWNzTlwyOgybRmybEnkJzZVclN

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

15JUNIO-RODA

C2

hjgeuyiohfkjsdfhgiwe.duckdns.org:2525

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      xPo8U6ZjwEaV.exe

    • Size

      47KB

    • MD5

      1d04efd3c005feba5161fd2ddd8d7194

    • SHA1

      da4d6966afc58bd5b4f0e76b3af422f1b0235fce

    • SHA256

      aa44b193e2eb0046c55dc1a78fed298c361f06835256504ff42db39c5692df10

    • SHA512

      21d82980eb1a51e8cafe6062b2f51636c3dece8a1a67a1b9c22eb9311c39b02931162aea19269c864c638211421614116cd9db7790fc1621d5d1ecb3e4bae774

    • SSDEEP

      768:V9umxLiIL1CaS+DiNzTlD0yO5iBBYbugeVFybEvEgK/JzZVc6KN:V9uAPWNzTlwyOgybRmybEnkJzZVclN

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Deletes itself

MITRE ATT&CK Matrix

Tasks