General

  • Target

    rat

  • Size

    512KB

  • Sample

    231021-tft2esfe2t

  • MD5

    738c07f22ff7922d8fcff5ba6555dbb3

  • SHA1

    86a08e0cb6b92b08d358c75e47dd5325b4aba323

  • SHA256

    7a83115ab46ba6a3c237d78f32bd3386ff4d4d7cd7b06ad731fe8071b2246278

  • SHA512

    c49a900d0165f56cc513c6e4e6551a69f3b49c8c0a9719ac925c6004b69554540999d1f3c9d63c397564e6ec67bb65cc31fa6e0ff9c2685a325fea7c8c0868dd

  • SSDEEP

    3072:7HivS2XIxjLnBnbmOKIudTziZ3w2OAGzCZ44Lz/w:LxvnBJh+T63wZzCZ44Lzw

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_file

    svchost.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      rat

    • Size

      512KB

    • MD5

      738c07f22ff7922d8fcff5ba6555dbb3

    • SHA1

      86a08e0cb6b92b08d358c75e47dd5325b4aba323

    • SHA256

      7a83115ab46ba6a3c237d78f32bd3386ff4d4d7cd7b06ad731fe8071b2246278

    • SHA512

      c49a900d0165f56cc513c6e4e6551a69f3b49c8c0a9719ac925c6004b69554540999d1f3c9d63c397564e6ec67bb65cc31fa6e0ff9c2685a325fea7c8c0868dd

    • SSDEEP

      3072:7HivS2XIxjLnBnbmOKIudTziZ3w2OAGzCZ44Lz/w:LxvnBJh+T63wZzCZ44Lzw

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks