General

  • Target

    b5522fb2683e7ff30d329d6d7afd7b5eca7b60d581757476bda4925f8f10ddb4.exe

  • Size

    585KB

  • Sample

    240801-cbv99azfla

  • MD5

    25dbcf1fe03ad12511191f54bff57d76

  • SHA1

    b748178f5756712162edec1e85fa6e0a456bc722

  • SHA256

    b5522fb2683e7ff30d329d6d7afd7b5eca7b60d581757476bda4925f8f10ddb4

  • SHA512

    ecdc722f18d81fbd0dbd164b6bdfec25fa2c3b3bbc3305f2a8c092b4e0607932c2ee0303a3bbadc6f38ff74b406444f1b401d7822727f66fe139796cad13d722

  • SSDEEP

    6144:9YZmun4mCYZWNfg2IJHCRrtDWZALTgvLP1fB+toSUMqQGc8oYTvQ4d8Kmk/5p3:9sAlgrVwZaeTgvp4oSUMqK0Q4dtm

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

AMU

C2

jnmanymen.ydns.eu:1470

Mutex

Y9Lj8dOJExpn

Attributes
  • delay

    10

  • install

    true

  • install_file

    windows.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      b5522fb2683e7ff30d329d6d7afd7b5eca7b60d581757476bda4925f8f10ddb4.exe

    • Size

      585KB

    • MD5

      25dbcf1fe03ad12511191f54bff57d76

    • SHA1

      b748178f5756712162edec1e85fa6e0a456bc722

    • SHA256

      b5522fb2683e7ff30d329d6d7afd7b5eca7b60d581757476bda4925f8f10ddb4

    • SHA512

      ecdc722f18d81fbd0dbd164b6bdfec25fa2c3b3bbc3305f2a8c092b4e0607932c2ee0303a3bbadc6f38ff74b406444f1b401d7822727f66fe139796cad13d722

    • SSDEEP

      6144:9YZmun4mCYZWNfg2IJHCRrtDWZALTgvLP1fB+toSUMqQGc8oYTvQ4d8Kmk/5p3:9sAlgrVwZaeTgvp4oSUMqK0Q4dtm

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks