General

  • Target

    3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe

  • Size

    308KB

  • Sample

    240515-bl765aac72

  • MD5

    1ee185cb3b4f78f2a24e61798952178b

  • SHA1

    8049b95b5250bad311950a218de4b9727e8f4579

  • SHA256

    3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243

  • SHA512

    d16938efe9ec9936266e9c37b9c85b5f26cdfc66cc9c552186c3973ebed1c7e9f0f9f380f39cc113c03e7983dd9188a5e7292115748d78953101cfd359f0a93f

  • SSDEEP

    3072:iOvQ/IaGuDfIeqpMTxV/wP8rjAILNnCDDRvLGmrOAOkGt6+duWA/t/SHUebbxCbO:FQIZe+MFVXx9stvLGtELbMUTKZ1H

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

April3rd2024

C2

94.156.65.181:3434

Mutex

A234sdgrgMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe

    • Size

      308KB

    • MD5

      1ee185cb3b4f78f2a24e61798952178b

    • SHA1

      8049b95b5250bad311950a218de4b9727e8f4579

    • SHA256

      3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243

    • SHA512

      d16938efe9ec9936266e9c37b9c85b5f26cdfc66cc9c552186c3973ebed1c7e9f0f9f380f39cc113c03e7983dd9188a5e7292115748d78953101cfd359f0a93f

    • SSDEEP

      3072:iOvQ/IaGuDfIeqpMTxV/wP8rjAILNnCDDRvLGmrOAOkGt6+duWA/t/SHUebbxCbO:FQIZe+MFVXx9stvLGtELbMUTKZ1H

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Async RAT payload

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Detects file containing reversed ASEP Autorun registry keys

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks