Resubmissions

12-05-2024 07:58

240512-jt1e9aag96 10

12-05-2024 07:55

240512-jscykaag45 3

General

  • Target

    Bloxstrap-v2.5.4.exe

  • Size

    7.6MB

  • Sample

    240512-jt1e9aag96

  • MD5

    dbb820772caf0003967ef0f269fbdeb1

  • SHA1

    31992bd4977a7dfeba67537a2da6c9ca64bc304c

  • SHA256

    b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc

  • SHA512

    e8ac879c7198dffb78bc6ee4ad49b5de40a5a7dbbda53d427d0a034941487d13c8bb2b8d590a1fcdd81cd6abb8f21fdfcd52924eb00c45a42ee06c1e4b3d590f

  • SSDEEP

    98304:XNd5DSd5DxTsed5D2ZT00UuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl1:X+sdtObAbN0u

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

nano

C2

dool.ddns.net:1606

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %Temp%

aes.plain

Targets

    • Target

      Bloxstrap-v2.5.4.exe

    • Size

      7.6MB

    • MD5

      dbb820772caf0003967ef0f269fbdeb1

    • SHA1

      31992bd4977a7dfeba67537a2da6c9ca64bc304c

    • SHA256

      b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc

    • SHA512

      e8ac879c7198dffb78bc6ee4ad49b5de40a5a7dbbda53d427d0a034941487d13c8bb2b8d590a1fcdd81cd6abb8f21fdfcd52924eb00c45a42ee06c1e4b3d590f

    • SSDEEP

      98304:XNd5DSd5DxTsed5D2ZT00UuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl1:X+sdtObAbN0u

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

    • Async RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks