General

  • Target

    tmp

  • Size

    228KB

  • Sample

    240405-m3r21saa8t

  • MD5

    9c4fb4fe69e24136320b3daf99004547

  • SHA1

    c733adf72c40397a9f1b97c3914ebbcb3e6ac222

  • SHA256

    8661b1bcc5df80e2694f3ed8b1fa7f592174c642b71dc481227078ecf6d86171

  • SHA512

    6706612b4338af685ce21ab6f56f07c78795f0f287c461677ffcd871ffb3506a1e0821d9e44186ce7225e9720360b2773896dd48025f37e0b29a57831ec00efb

  • SSDEEP

    6144:4XqEYT6BwbIN/B5bhhXcC3oHtD06enUuVnejOn0:f62bIf3hXX3oNY6eUuBeCn0

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.2

C2

1.14.206.144:6606

1.14.206.144:7707

1.14.206.144:8808

Mutex

564-8c88999ba04b

Attributes
  • delay

    0

  • install

    true

  • install_file

    QQ.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      tmp

    • Size

      228KB

    • MD5

      9c4fb4fe69e24136320b3daf99004547

    • SHA1

      c733adf72c40397a9f1b97c3914ebbcb3e6ac222

    • SHA256

      8661b1bcc5df80e2694f3ed8b1fa7f592174c642b71dc481227078ecf6d86171

    • SHA512

      6706612b4338af685ce21ab6f56f07c78795f0f287c461677ffcd871ffb3506a1e0821d9e44186ce7225e9720360b2773896dd48025f37e0b29a57831ec00efb

    • SSDEEP

      6144:4XqEYT6BwbIN/B5bhhXcC3oHtD06enUuVnejOn0:f62bIf3hXX3oNY6eUuBeCn0

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks