General

  • Target

    download.exe

  • Size

    62KB

  • Sample

    240806-qtmygsvanf

  • MD5

    0c7e7380cfce01d3d14508af503b4a0a

  • SHA1

    3a9251f074a7da0fbdd56f77d11966edb7993c93

  • SHA256

    e3f5323730fe6d6db5fbc506535479b537c3fb1464d75538b100f880f1718655

  • SHA512

    0b153d06bcfe26432f451f4707641773c2643935e4e8e28313cbc6899861f3f21243ff90923b695dc16f9141e1be3bb8fc62ce6725615dedb87db6299332866c

  • SSDEEP

    1536:N2wJMnkjQTJQwBbKygiyffcjPUE8XU6arg5jp5bRAg6G6OMzG2r53RBx:N2wJMnklE8XU6a0hp5bRRS9drx

Malware Config

Extracted

Family

asyncrat

Version

Xchallenger | 3Losh

Botnet

XXXV3rhR9Jn93VMOXV9

C2

anothonesevenfivesecsned.ddns.net:6666

Mutex

AsyncMutex_DIxGEiAXhu7ZniMr

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      download.exe

    • Size

      62KB

    • MD5

      0c7e7380cfce01d3d14508af503b4a0a

    • SHA1

      3a9251f074a7da0fbdd56f77d11966edb7993c93

    • SHA256

      e3f5323730fe6d6db5fbc506535479b537c3fb1464d75538b100f880f1718655

    • SHA512

      0b153d06bcfe26432f451f4707641773c2643935e4e8e28313cbc6899861f3f21243ff90923b695dc16f9141e1be3bb8fc62ce6725615dedb87db6299332866c

    • SSDEEP

      1536:N2wJMnkjQTJQwBbKygiyffcjPUE8XU6arg5jp5bRAg6G6OMzG2r53RBx:N2wJMnklE8XU6a0hp5bRRS9drx

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks