General

  • Target

    1c8e29dbcd8795f22f73483b6e20929e0025fd113cd9b7b760aaf5aec3b5b9ee.ps1

  • Size

    553KB

  • Sample

    240628-bg8bbssepa

  • MD5

    223b842e87e7d124f133e2b21090e717

  • SHA1

    99c830f860fe5d34b3802a62c790e0c26c7f1e5b

  • SHA256

    1c8e29dbcd8795f22f73483b6e20929e0025fd113cd9b7b760aaf5aec3b5b9ee

  • SHA512

    f83274a71a388b0349cdbfed15ae152cfd3dfb45c22d81171a4e1a74f0a298a53b68d53fc75e15b8b08195f8d5020f33397d5d33dac2aa8826a5894680555db6

  • SSDEEP

    1536:kDh8DyXBs84VhDEak0EyxWq0IxZQjepORUXl9cGnZneXVsl6cGMyQxI:kDhiyXBs84VhDEakbyxWq0IYz2I

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

newjop

C2

backwork07.ddns.net:6666

Mutex

AsyncMutex_raTMpP7xS21cDAE8

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      1c8e29dbcd8795f22f73483b6e20929e0025fd113cd9b7b760aaf5aec3b5b9ee.ps1

    • Size

      553KB

    • MD5

      223b842e87e7d124f133e2b21090e717

    • SHA1

      99c830f860fe5d34b3802a62c790e0c26c7f1e5b

    • SHA256

      1c8e29dbcd8795f22f73483b6e20929e0025fd113cd9b7b760aaf5aec3b5b9ee

    • SHA512

      f83274a71a388b0349cdbfed15ae152cfd3dfb45c22d81171a4e1a74f0a298a53b68d53fc75e15b8b08195f8d5020f33397d5d33dac2aa8826a5894680555db6

    • SSDEEP

      1536:kDh8DyXBs84VhDEak0EyxWq0IxZQjepORUXl9cGnZneXVsl6cGMyQxI:kDhiyXBs84VhDEakbyxWq0IYz2I

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects file containing reversed ASEP Autorun registry keys

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks