General

  • Target

    RobloxPlayerInstalleras.exe

  • Size

    52KB

  • Sample

    240623-l2tnsayamc

  • MD5

    64688bfca22546b586bdbdedc06a62e1

  • SHA1

    ee850d2ff408f4b2ca1bf776849dcd21ed4111c4

  • SHA256

    f6383760a9c9acd6848fb30fea83365e180dddcb7eb305b621e515ff1f7b5049

  • SHA512

    f1b936150f04aaac3fa7b73e53d5bd77eb8ae65e2381c877ced384fbfbea71f4ac4002aa8da696e8b0c20d65ec4d2c34dd7ddd8b93ef0ede789380436776ffdc

  • SSDEEP

    1536:juZwdTxtB2isugpbXX2o75TjUGyds70T:juZMTxtB2isugpbXNFjUGymQT

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:80

127.0.0.1:26181

lolimaginerattin24-26181.portmap.host:26181:6606

lolimaginerattin24-26181.portmap.host:26181:7707

lolimaginerattin24-26181.portmap.host:26181:8808

lolimaginerattin24-26181.portmap.host:26181:80

lolimaginerattin24-26181.portmap.host:26181:26181

Mutex

FASDdxNMEwio

Attributes
  • delay

    3

  • install

    true

  • install_file

    RobloxPlayerBeta.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      RobloxPlayerInstalleras.exe

    • Size

      52KB

    • MD5

      64688bfca22546b586bdbdedc06a62e1

    • SHA1

      ee850d2ff408f4b2ca1bf776849dcd21ed4111c4

    • SHA256

      f6383760a9c9acd6848fb30fea83365e180dddcb7eb305b621e515ff1f7b5049

    • SHA512

      f1b936150f04aaac3fa7b73e53d5bd77eb8ae65e2381c877ced384fbfbea71f4ac4002aa8da696e8b0c20d65ec4d2c34dd7ddd8b93ef0ede789380436776ffdc

    • SSDEEP

      1536:juZwdTxtB2isugpbXX2o75TjUGyds70T:juZMTxtB2isugpbXNFjUGymQT

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks