General

  • Target

    2fc1ec39637b7e1f46ed594c12c80fb8186b1fbbe6cd2893ffdc36690505a5a7.ps1

  • Size

    553KB

  • Sample

    240801-bj662stbrk

  • MD5

    12e2abc893dc6797d3fa02525df2b9e2

  • SHA1

    10f78d47a520c02525d6a33ae9f3698c1de02413

  • SHA256

    2fc1ec39637b7e1f46ed594c12c80fb8186b1fbbe6cd2893ffdc36690505a5a7

  • SHA512

    b960fb6110be0f77e65054cae7f8d935cec4cd6f55a782fe0f6c7dcc5ee2630d229fdf0ab218fae856a2adb39b6b95237e4ed75cd707bd895d5ba2035e42a7a4

  • SSDEEP

    1536:kDh8DyXBs84VhDEak0EyxWq0Z3IMUlaE4g7:kDhiyXBs84VhDEakbyxWq0Zk

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

we need money

C2

backwork07.ddns.net:6666

Mutex

AsyncMutex_VVXVZFyTYtHWDAzB

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      2fc1ec39637b7e1f46ed594c12c80fb8186b1fbbe6cd2893ffdc36690505a5a7.ps1

    • Size

      553KB

    • MD5

      12e2abc893dc6797d3fa02525df2b9e2

    • SHA1

      10f78d47a520c02525d6a33ae9f3698c1de02413

    • SHA256

      2fc1ec39637b7e1f46ed594c12c80fb8186b1fbbe6cd2893ffdc36690505a5a7

    • SHA512

      b960fb6110be0f77e65054cae7f8d935cec4cd6f55a782fe0f6c7dcc5ee2630d229fdf0ab218fae856a2adb39b6b95237e4ed75cd707bd895d5ba2035e42a7a4

    • SSDEEP

      1536:kDh8DyXBs84VhDEak0EyxWq0Z3IMUlaE4g7:kDhiyXBs84VhDEakbyxWq0Zk

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks