General

  • Target

    2024-03-13_156cd53bc5d2472d6f609f956c99351f_mafia

  • Size

    2.4MB

  • Sample

    240313-aqsrkahb68

  • MD5

    156cd53bc5d2472d6f609f956c99351f

  • SHA1

    524ebcf9e029dd6e43d8d1b81ee84476cbad0270

  • SHA256

    9b09bfe79653270e1c6248815996b4710d1c3e7a2b64dfa221d953369963ea03

  • SHA512

    a9db7823bdaf4816ad40bae933fd57dc876514793d2fc4e03bc5e18f4b14dcd3a882a5878708a0bfc34171c77c6f24fb6ad218e67f77c2804730a72230cc438b

  • SSDEEP

    12288:/k1MoO3MBURL+8hiLzq5ot1tLA9BqgiyUDHXQsHvBqgiyUDHD7ApBERoMsqQAmQw:qML3Ga0HqQNyUD3NHvQNyUDjwBQWEmD

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

XieBroRAT-1.7

Botnet

Default

C2

117.18.12.59:8880

Mutex

kincbmvclpa

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      2024-03-13_156cd53bc5d2472d6f609f956c99351f_mafia

    • Size

      2.4MB

    • MD5

      156cd53bc5d2472d6f609f956c99351f

    • SHA1

      524ebcf9e029dd6e43d8d1b81ee84476cbad0270

    • SHA256

      9b09bfe79653270e1c6248815996b4710d1c3e7a2b64dfa221d953369963ea03

    • SHA512

      a9db7823bdaf4816ad40bae933fd57dc876514793d2fc4e03bc5e18f4b14dcd3a882a5878708a0bfc34171c77c6f24fb6ad218e67f77c2804730a72230cc438b

    • SSDEEP

      12288:/k1MoO3MBURL+8hiLzq5ot1tLA9BqgiyUDHXQsHvBqgiyUDHD7ApBERoMsqQAmQw:qML3Ga0HqQNyUD3NHvQNyUDjwBQWEmD

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks