General

  • Target

    0x000900000001562c-52.dat

  • Size

    46KB

  • Sample

    240806-xp4trsxdpr

  • MD5

    10b549c788d008fc48cccac97d0d41f5

  • SHA1

    f0c723bb0c9123875a1a208e3ec46f4ec4108be0

  • SHA256

    589c8fa2d213b58ab009ff4caae02a61d4d60a6fa61567f208017fef136363a9

  • SHA512

    bc7f033012190ba6ccc2c76c4d32a1814bb4960d209d39edf5960f27b51f3e448b4ae0d26c8b68f3239eb499abfdc1bea2324fc3d7841ea1521c5f0c42f4df88

  • SSDEEP

    768:bqjrtbXgQQDykOicvHk3eHlWMPbPgF0q9+SohzEBYI6OCy2tYcFmVc6KD:bBDyXvZH0ub4FroSolY6O3KmVclD

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

C2

dgorijan20785.hopto.org:6606

dgorijan20785.hopto.org:7707

dgorijan20785.hopto.org:8808

Mutex

v5tvc5rc5ex77777

Attributes
  • delay

    5

  • install

    true

  • install_file

    audiodvs.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      0x000900000001562c-52.dat

    • Size

      46KB

    • MD5

      10b549c788d008fc48cccac97d0d41f5

    • SHA1

      f0c723bb0c9123875a1a208e3ec46f4ec4108be0

    • SHA256

      589c8fa2d213b58ab009ff4caae02a61d4d60a6fa61567f208017fef136363a9

    • SHA512

      bc7f033012190ba6ccc2c76c4d32a1814bb4960d209d39edf5960f27b51f3e448b4ae0d26c8b68f3239eb499abfdc1bea2324fc3d7841ea1521c5f0c42f4df88

    • SSDEEP

      768:bqjrtbXgQQDykOicvHk3eHlWMPbPgF0q9+SohzEBYI6OCy2tYcFmVc6KD:bBDyXvZH0ub4FroSolY6O3KmVclD

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks