General

  • Target

    12bee16f9692cb9a6d3713543cf998a4f953d0341f4e9c661748faef525d91e6.exe

  • Size

    46KB

  • Sample

    240520-bdw4wscf21

  • MD5

    194de251c043183099b2d6f7f5d1e09f

  • SHA1

    dc477dfc0e090e8d7bd31fb808f59060dd2cf360

  • SHA256

    12bee16f9692cb9a6d3713543cf998a4f953d0341f4e9c661748faef525d91e6

  • SHA512

    6a1433b9bc070f18f60c3f115a1173e8979d211f6e97daf3fc7fe13f05ab15123874919418fc014fdd8af62c82426cb091b867b36a49fe7fc8fe929709b3a433

  • SSDEEP

    768:fqZKAqubXIsg3uNkOicvHk3eHlWMPbPgF0qgkx5XKbukYI6OCm2tYcFmVc6KD:f/1uNXvZH0ub4FrgQwv6OrKmVclD

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

C2

dgorijan20785.hopto.org:6606

dgorijan20785.hopto.org:7707

dgorijan20785.hopto.org:8808

Mutex

v5tvc4rc3ex778899

Attributes
  • delay

    5

  • install

    true

  • install_file

    audiodrvs.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      12bee16f9692cb9a6d3713543cf998a4f953d0341f4e9c661748faef525d91e6.exe

    • Size

      46KB

    • MD5

      194de251c043183099b2d6f7f5d1e09f

    • SHA1

      dc477dfc0e090e8d7bd31fb808f59060dd2cf360

    • SHA256

      12bee16f9692cb9a6d3713543cf998a4f953d0341f4e9c661748faef525d91e6

    • SHA512

      6a1433b9bc070f18f60c3f115a1173e8979d211f6e97daf3fc7fe13f05ab15123874919418fc014fdd8af62c82426cb091b867b36a49fe7fc8fe929709b3a433

    • SSDEEP

      768:fqZKAqubXIsg3uNkOicvHk3eHlWMPbPgF0qgkx5XKbukYI6OCm2tYcFmVc6KD:f/1uNXvZH0ub4FrgQwv6OrKmVclD

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Detects file containing reversed ASEP Autorun registry keys

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks