General

  • Target

    10e4a6b54cc0cf4d18dde8b69e0b305abe487e07ed990c5bff82ce30b217b910.bat

  • Size

    27KB

  • Sample

    240714-klhqxawcqh

  • MD5

    8d987e2f2fef6f2bd726d392bac46c55

  • SHA1

    64ab8a696b52189d5fd809da924d1dc36e07d7c3

  • SHA256

    10e4a6b54cc0cf4d18dde8b69e0b305abe487e07ed990c5bff82ce30b217b910

  • SHA512

    a8c48da620cfc0b4ea55efba87a98625e4b1eaf4553006a259fc5915836afcdee413180d1dcfc40ab8830741257f5ab723d4536788b0d751a6ba8a28cbfcdf45

  • SSDEEP

    768:AZWM6xwaPdP30trmRblevg8heVbaEUdLQdy6VTRZE3mn:ZM6xzR30ZmRb4YI2TILQdy6VTRL

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

2.56.245.243:7777

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      10e4a6b54cc0cf4d18dde8b69e0b305abe487e07ed990c5bff82ce30b217b910.bat

    • Size

      27KB

    • MD5

      8d987e2f2fef6f2bd726d392bac46c55

    • SHA1

      64ab8a696b52189d5fd809da924d1dc36e07d7c3

    • SHA256

      10e4a6b54cc0cf4d18dde8b69e0b305abe487e07ed990c5bff82ce30b217b910

    • SHA512

      a8c48da620cfc0b4ea55efba87a98625e4b1eaf4553006a259fc5915836afcdee413180d1dcfc40ab8830741257f5ab723d4536788b0d751a6ba8a28cbfcdf45

    • SSDEEP

      768:AZWM6xwaPdP30trmRblevg8heVbaEUdLQdy6VTRZE3mn:ZM6xzR30ZmRb4YI2TILQdy6VTRL

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

MITRE ATT&CK Enterprise v15

Tasks