General

  • Target

    729d6539f4eae0ad9178d7a60b3d478780d8b68bde520d59311e87a4c5f7dc30

  • Size

    63KB

  • Sample

    240728-3w1ctawerc

  • MD5

    0ac4039b1060355d3408ad727a6127be

  • SHA1

    a2cad20ee53c6fb731b9052bc7a9d1745f0ee1a8

  • SHA256

    729d6539f4eae0ad9178d7a60b3d478780d8b68bde520d59311e87a4c5f7dc30

  • SHA512

    cf9ce5f07d862438d11ed6a13730be7a90dd525fc0331b3532f3a757801ecbc5adb020f9882108e8f80c2ae0c087cd52d8aaff19114e133c5c6919b67358da54

  • SSDEEP

    768:muY6LVcsTPq781wC8A+Xju8Z4gdKmDrRHsL1+T4tSNGHmDbDdph0oXGkLnTSuIdP:HeQPc/ymDrRH8iUUbXh9/2uIdpqKmY7

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

192.168.1.108:2024

Attributes
  • delay

    1

  • install

    true

  • install_file

    OperaGx.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      729d6539f4eae0ad9178d7a60b3d478780d8b68bde520d59311e87a4c5f7dc30

    • Size

      63KB

    • MD5

      0ac4039b1060355d3408ad727a6127be

    • SHA1

      a2cad20ee53c6fb731b9052bc7a9d1745f0ee1a8

    • SHA256

      729d6539f4eae0ad9178d7a60b3d478780d8b68bde520d59311e87a4c5f7dc30

    • SHA512

      cf9ce5f07d862438d11ed6a13730be7a90dd525fc0331b3532f3a757801ecbc5adb020f9882108e8f80c2ae0c087cd52d8aaff19114e133c5c6919b67358da54

    • SSDEEP

      768:muY6LVcsTPq781wC8A+Xju8Z4gdKmDrRHsL1+T4tSNGHmDbDdph0oXGkLnTSuIdP:HeQPc/ymDrRH8iUUbXh9/2uIdpqKmY7

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks