General

  • Target

    External Resou‮nls..scr

  • Size

    351KB

  • Sample

    240301-a6hljaha5s

  • MD5

    13d1fc17b74fdbe39d0141d4f5e2b6db

  • SHA1

    0c48d2d21eff6bc55fefe111b25e81fcc27e25a5

  • SHA256

    194c0a05958c8ead4bfa916ace6e1a5acdb7f433ce57c1d48abc9160a6bca4e5

  • SHA512

    3eaf731772e1c1386a84eae459ca1d8cb81fa8d79be1cb91f5e8678e9861a687178007e881a0fd03d116c597918e3a5f580a5060e32dc0faeeee22ebe1ac3b0c

  • SSDEEP

    6144:haxxiw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFm6axHUZ:hukqjVnl36ud0zR/6CtQ9PUHIG8Dn

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

GoogleCrash

C2

109.205.162.97:4739

Mutex

GoogleCrash

Attributes
  • delay

    3

  • install

    false

  • install_file

    GoogleCrashHandler

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

SystemSetting

C2

109.205.162.97:8361

Mutex

Y68jUtK0cI3V

Attributes
  • delay

    3

  • install

    false

  • install_file

    MemoryCompression

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      External Resou‮nls..scr

    • Size

      351KB

    • MD5

      13d1fc17b74fdbe39d0141d4f5e2b6db

    • SHA1

      0c48d2d21eff6bc55fefe111b25e81fcc27e25a5

    • SHA256

      194c0a05958c8ead4bfa916ace6e1a5acdb7f433ce57c1d48abc9160a6bca4e5

    • SHA512

      3eaf731772e1c1386a84eae459ca1d8cb81fa8d79be1cb91f5e8678e9861a687178007e881a0fd03d116c597918e3a5f580a5060e32dc0faeeee22ebe1ac3b0c

    • SSDEEP

      6144:haxxiw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFm6axHUZ:hukqjVnl36ud0zR/6CtQ9PUHIG8Dn

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • UAC bypass

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks