General

  • Target

    e296fd745e2a6dfb3f345a73e59174d5236c9c55855c8ee0c5602955614d9794

  • Size

    168KB

  • Sample

    231011-afhhvabc92

  • MD5

    460c5e2904724e5babe7c3f7eaaf8de9

  • SHA1

    a648b18830c27850fe651e6601792a7676c18c94

  • SHA256

    e296fd745e2a6dfb3f345a73e59174d5236c9c55855c8ee0c5602955614d9794

  • SHA512

    31cf6090a1764abc61aced61fc78e0f9471a636f0e95f997ed083798908c075fb7d5fd78e45d17f5e0ba53d37fe1c7ea8342acb71b0ac41b94e7e1fc6b2b8f16

  • SSDEEP

    3072:2L31ZGgcsKuvP6Thmcy6bzVprBAs6UKoq0yiw7bWbJ:83ugdvP6K6b/rBAsq/iwQ

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

donelpacino.ddns.net:5500

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      e296fd745e2a6dfb3f345a73e59174d5236c9c55855c8ee0c5602955614d9794

    • Size

      168KB

    • MD5

      460c5e2904724e5babe7c3f7eaaf8de9

    • SHA1

      a648b18830c27850fe651e6601792a7676c18c94

    • SHA256

      e296fd745e2a6dfb3f345a73e59174d5236c9c55855c8ee0c5602955614d9794

    • SHA512

      31cf6090a1764abc61aced61fc78e0f9471a636f0e95f997ed083798908c075fb7d5fd78e45d17f5e0ba53d37fe1c7ea8342acb71b0ac41b94e7e1fc6b2b8f16

    • SSDEEP

      3072:2L31ZGgcsKuvP6Thmcy6bzVprBAs6UKoq0yiw7bWbJ:83ugdvP6K6b/rBAsq/iwQ

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks