General

  • Target

    14c66a0b3a199d38a236bed7780258d84c8a3cf335f9397769dc06a17d5707e0.exe

  • Size

    66KB

  • Sample

    240417-bfrxysag91

  • MD5

    aa603e3b55b1c895bd213d06fcbced27

  • SHA1

    ae1a724079ffc4a470a1e41ac07770489c90261b

  • SHA256

    14c66a0b3a199d38a236bed7780258d84c8a3cf335f9397769dc06a17d5707e0

  • SHA512

    4599b186be519485188ca3a7b9b1a6f4eb750f14327d37cc4de72284e117f2f42dbde9aeae737b522d4431f27fe1aa7336bc02ae03e6e378bb30d24f727296fa

  • SSDEEP

    1536:e2wukvF1ak9gcKu5UYFy64UmzbLbjVMonXdgqHirPlTGRx:e2dkvF1ak9Ku5UYFy64UcbLbjDCdix

Malware Config

Extracted

Family

asyncrat

Version

| nelsontriana980

Botnet

Bypass

C2

bypass-asyn.4cloud.click:8887

Mutex

AsyncMutex_654I8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      14c66a0b3a199d38a236bed7780258d84c8a3cf335f9397769dc06a17d5707e0.exe

    • Size

      66KB

    • MD5

      aa603e3b55b1c895bd213d06fcbced27

    • SHA1

      ae1a724079ffc4a470a1e41ac07770489c90261b

    • SHA256

      14c66a0b3a199d38a236bed7780258d84c8a3cf335f9397769dc06a17d5707e0

    • SHA512

      4599b186be519485188ca3a7b9b1a6f4eb750f14327d37cc4de72284e117f2f42dbde9aeae737b522d4431f27fe1aa7336bc02ae03e6e378bb30d24f727296fa

    • SSDEEP

      1536:e2wukvF1ak9gcKu5UYFy64UmzbLbjVMonXdgqHirPlTGRx:e2dkvF1ak9Ku5UYFy64UcbLbjDCdix

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects file containing reversed ASEP Autorun registry keys

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks