General

  • Target

    tuqlskzrqvewwjwc.zip

  • Size

    89KB

  • Sample

    240627-xd26ssvcrf

  • MD5

    487badd8b926d78a670d66f24d854545

  • SHA1

    a1eb4ebe8146331689cfb239beb0e75c1b0875c0

  • SHA256

    e6b6bacad6bf1d3188ff8c2a41ea9f0aaa5114504da4ae8bda96c673f5e10c94

  • SHA512

    fa833a1602c728423d3aebeb5b678aecc89c7d2a64f3b3a6a966ea8e8ef5c069bbee53f980e50e9dd326f613a83c26bbbc2df399416c93c1bafe2b1fa18ed222

  • SSDEEP

    1536:7jJxlkAiJFpAHwjjpIjvl/5vF4vkvkx3INq8VbVwkMJid4IMLwIClIIVu:P3545BYF59d8RINq8VakH48T/u

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

newjop

C2

backwork07.ddns.net:6666

Mutex

AsyncMutex_raTMpP7xS21cDAE8

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      BYBBLJDYNKYQRCIW.ps1

    • Size

      553KB

    • MD5

      223b842e87e7d124f133e2b21090e717

    • SHA1

      99c830f860fe5d34b3802a62c790e0c26c7f1e5b

    • SHA256

      1c8e29dbcd8795f22f73483b6e20929e0025fd113cd9b7b760aaf5aec3b5b9ee

    • SHA512

      f83274a71a388b0349cdbfed15ae152cfd3dfb45c22d81171a4e1a74f0a298a53b68d53fc75e15b8b08195f8d5020f33397d5d33dac2aa8826a5894680555db6

    • SSDEEP

      1536:kDh8DyXBs84VhDEak0EyxWq0IxZQjepORUXl9cGnZneXVsl6cGMyQxI:kDhiyXBs84VhDEakbyxWq0IYz2I

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Suspicious use of SetThreadContext

    • Target

      LOEVIQHNNBLMJQGX.vbs

    • Size

      820B

    • MD5

      3b02a48a86c436a42cece067efd1616d

    • SHA1

      7963c51e6de1389ea22c2fdff4f6ad436556e891

    • SHA256

      adc0a2c378fc9c87efbb3863c49fa0ac2a25e32a69e320105b79878d1bbcfca6

    • SHA512

      cf0d9bc3e908e7a3153529e1e975d98806e632f3e5ce708e1c15f64749214d7ac4a02496af99a3a3af382c4ebb89ac31b3d03787303678c3b6b37158816e3523

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Target

      NOXOIMAYDCJQRTDL.bat

    • Size

      1KB

    • MD5

      f0615a271904779ef01a22ccffc5b7ac

    • SHA1

      b18bab505208a2d1a53f7496286f25ac199b7475

    • SHA256

      5e91677a0a32ced94580bef9253982462f9d9a7e5f2166a07561fe13f4342e98

    • SHA512

      caa35c7111c525d8385e14b51368f657f9232b606dd6aa27fb580884264d0215435de234b4bfc155ec006107dfd94da978a73331442a2fd19c310348e3d758a2

    Score
    8/10
    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Target

      PLYEDPJAJZDJPATK.vbs

    • Size

      887B

    • MD5

      993627e0d502460f2b211b906e7f5cb7

    • SHA1

      59d6ae8236d27c8f2f2b5abdc51ea77680e4455a

    • SHA256

      735461ba3154b4804533018cf78b53bcf1fceff7688b3c3c64952ff0f6f04125

    • SHA512

      fc85dfa5b1e34899f1ca98f4ca91b04fc3b29c819ded63df5fc382f63566d723bc3f93e2d4314d8ee3d7e6ba71b3aa05d02eac6248fc118d667358fa5fd67db1

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Target

      XKAHEZZHLYETQDGK.bat

    • Size

      1KB

    • MD5

      20b2afea9d76846c78a9e7588a7135e9

    • SHA1

      f307dca000a50208201c49324206bb6954fea3b3

    • SHA256

      9f7fc00e72e44ebc9b9f4b66bbf7d35a6eb6736f00a1ffd56100b6ea2ae57a74

    • SHA512

      917d6c18f14d65563c63e7e7b1ea7913a7767f855e94ac0866ae02c268b8c03793876dec92d23789b9e055743964a1471a63e28130621675a3249c4cfd227726

    Score
    8/10
    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Target

      YEJVMCIJLIUXHSQV.ps1

    • Size

      553B

    • MD5

      0bc179668af7ed0a345b1c1a998c186c

    • SHA1

      6b0c0e6f39c14dc0eb0be24b5db35a41ef8ff777

    • SHA256

      97c1c775cb48d543ec26c75c7b936a5072619427eba9a8518ac32d2a94a321df

    • SHA512

      163db9b801b350fee45eaa75156129641b25fb9f5281cacad97d6df6a142789171cda0c337ea0f8c5c943ff6e7e001f0db0ff3f4fcd8e0b005c0f0870133bfb8

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks