General

  • Target

    NEAS_JC.9b29d9a68eb1565fb8290d0c3e6083afe901207c917235a475f7bcca833c7dbbunknown

  • Size

    216KB

  • Sample

    231007-p8dspaeg44

  • MD5

    05931e59a873435df1111513cc67eb0c

  • SHA1

    a8c5c57491e5a1466d606288404ca3a537b44060

  • SHA256

    9b29d9a68eb1565fb8290d0c3e6083afe901207c917235a475f7bcca833c7dbb

  • SHA512

    bf5ad63a5a1cfb5067dbd67d7b4aeff90952746a7a3f5e569d4d1d2684b52380b0f01e415646a73326c8df60fe2a94f062fb1c8ad57e6143fad10f5aee6ecd43

  • SSDEEP

    3072:KNE4koyAWy4WYiBiHEMadPhZkFiPNwVSwjQdMhvSWm8+B0RjcGd1F9h/IleqxEAO:mE4k+WPWYiIkMadPhYCNvwjQdMhvFuu

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

DOX NEW RAT

C2

dox2022.homeip.net:4444

Mutex

AsyncMutex_doxnewback43

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      NEAS_JC.9b29d9a68eb1565fb8290d0c3e6083afe901207c917235a475f7bcca833c7dbbunknown

    • Size

      216KB

    • MD5

      05931e59a873435df1111513cc67eb0c

    • SHA1

      a8c5c57491e5a1466d606288404ca3a537b44060

    • SHA256

      9b29d9a68eb1565fb8290d0c3e6083afe901207c917235a475f7bcca833c7dbb

    • SHA512

      bf5ad63a5a1cfb5067dbd67d7b4aeff90952746a7a3f5e569d4d1d2684b52380b0f01e415646a73326c8df60fe2a94f062fb1c8ad57e6143fad10f5aee6ecd43

    • SSDEEP

      3072:KNE4koyAWy4WYiBiHEMadPhZkFiPNwVSwjQdMhvSWm8+B0RjcGd1F9h/IleqxEAO:mE4k+WPWYiIkMadPhYCNvwjQdMhvFuu

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks