General

  • Target

    cdfb3a8ed030bb040835d4e2d5fd150bff61006971ce84809183127fd758639a

  • Size

    607KB

  • Sample

    240713-prwbea1bkr

  • MD5

    04f81cd3a595c95b20c258a514118388

  • SHA1

    30e11f854dfecbd170ac0c5286ed75ffa1f48d86

  • SHA256

    cdfb3a8ed030bb040835d4e2d5fd150bff61006971ce84809183127fd758639a

  • SHA512

    a769a8b2a26f3dfee0b86522c0c8cd5bf8180deae4d462f7e5a08600e447b27208729f459ba391519ece95d72daf2e33a8563088dd836422a9596d7634076d22

  • SSDEEP

    6144:l/Yprz9pQLYJy6BzahC3Ic2TD2mo9txBPRLF:1mH9EYA6RJ4c2nkxp

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • c2_url_file

    http://update-checker-status.cc/OCB-Async.txt

  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      cdfb3a8ed030bb040835d4e2d5fd150bff61006971ce84809183127fd758639a

    • Size

      607KB

    • MD5

      04f81cd3a595c95b20c258a514118388

    • SHA1

      30e11f854dfecbd170ac0c5286ed75ffa1f48d86

    • SHA256

      cdfb3a8ed030bb040835d4e2d5fd150bff61006971ce84809183127fd758639a

    • SHA512

      a769a8b2a26f3dfee0b86522c0c8cd5bf8180deae4d462f7e5a08600e447b27208729f459ba391519ece95d72daf2e33a8563088dd836422a9596d7634076d22

    • SSDEEP

      6144:l/Yprz9pQLYJy6BzahC3Ic2TD2mo9txBPRLF:1mH9EYA6RJ4c2nkxp

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Modifies WinLogon for persistence

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks