General

  • Target

    9a9a814dc369a5b2318968dbe037d3281dde50b28de210dabf07505077e2c45a.exe

  • Size

    4.1MB

  • Sample

    240726-fbx1mazfne

  • MD5

    015eaec62e39a031067323544f56a5cf

  • SHA1

    f36587ba44c4feec2137aa6768719a1281ed0ba8

  • SHA256

    9a9a814dc369a5b2318968dbe037d3281dde50b28de210dabf07505077e2c45a

  • SHA512

    2da3ff84055021591fc6a7dbcb46a4fbd927aa6ae38da43d8d0620391aef8df3ae0a2edc8305c7720f8e6f0598bd8fe11e8b75b97421eace84365dd405d5de64

  • SSDEEP

    49152:VyO1MDMUZNRz1YgO8jXpF4qQqET6JnxgFxMhx3x3gB++xG:YNRrFoDuwg0G

Malware Config

Extracted

Family

asyncrat

Version

2.0.0

Botnet

Default

C2

webwhatsapp.cc:65503

Mutex

ShiningForceRatMutex_cs_cs_cs

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      9a9a814dc369a5b2318968dbe037d3281dde50b28de210dabf07505077e2c45a.exe

    • Size

      4.1MB

    • MD5

      015eaec62e39a031067323544f56a5cf

    • SHA1

      f36587ba44c4feec2137aa6768719a1281ed0ba8

    • SHA256

      9a9a814dc369a5b2318968dbe037d3281dde50b28de210dabf07505077e2c45a

    • SHA512

      2da3ff84055021591fc6a7dbcb46a4fbd927aa6ae38da43d8d0620391aef8df3ae0a2edc8305c7720f8e6f0598bd8fe11e8b75b97421eace84365dd405d5de64

    • SSDEEP

      49152:VyO1MDMUZNRz1YgO8jXpF4qQqET6JnxgFxMhx3x3gB++xG:YNRrFoDuwg0G

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks