General

  • Target

    110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d

  • Size

    1.8MB

  • Sample

    240308-xpc12seh31

  • MD5

    a69c199a4f17c1dfd96b64ff2e3651d1

  • SHA1

    3a441d70c00a5535b8ce8cee93dea0d71536c1a5

  • SHA256

    110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d

  • SHA512

    f629c6172172c0fca384a8308d250ad315ddffcdcb1c595b6029aa7c960780177dedb2c1a01895a64d2332a9c1dab1c760a6097fd3387c25624aeae2232e18ec

  • SSDEEP

    49152:Zi39+084E6W4W8+m/ob49aXZmMA88DOKmX:Y+HVb4W8bG49unDfTX

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

1.err.line.pm:4449

Mutex

glzznzesxsoyn

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d

    • Size

      1.8MB

    • MD5

      a69c199a4f17c1dfd96b64ff2e3651d1

    • SHA1

      3a441d70c00a5535b8ce8cee93dea0d71536c1a5

    • SHA256

      110ac3af0ae9210dccc86e7b9bd14d7274b80c18630e9b0b4b2c1469ba2ddb1d

    • SHA512

      f629c6172172c0fca384a8308d250ad315ddffcdcb1c595b6029aa7c960780177dedb2c1a01895a64d2332a9c1dab1c760a6097fd3387c25624aeae2232e18ec

    • SSDEEP

      49152:Zi39+084E6W4W8+m/ob49aXZmMA88DOKmX:Y+HVb4W8bG49unDfTX

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks