General

  • Target

    37f7dc1e5403ed4babd766ca88445f0c0fd555af19a5b669123660c262cc3f58.exe

  • Size

    2.1MB

  • Sample

    240807-bnnkhazfjh

  • MD5

    d9d0ba1c1cc0dd9243f36fba8b1147ad

  • SHA1

    eae15f17ee26ede826b934733e16762cd61c89fa

  • SHA256

    37f7dc1e5403ed4babd766ca88445f0c0fd555af19a5b669123660c262cc3f58

  • SHA512

    304503d20998426c25f8f12ff9907831e0184b5ac911a0ce45addec385cac82dc070a56ad8630b404a41023fb56140dda9498d8f1a659a77df2b944ebb6da6b9

  • SSDEEP

    6144:2TrjyPf1/pNLbtbTvspnI5p3YCmMuHrXOrfE8HiTAnnQUoJwS4LY5qhR:2TWBnjspnIb//XT7EAQPn4LJD

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

2MONEY

C2

twart.myfirewall.org:14143

Mutex

FEjYSsXzhpZixwA

Attributes
  • delay

    20

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %Temp%

aes.plain

Targets

    • Target

      37f7dc1e5403ed4babd766ca88445f0c0fd555af19a5b669123660c262cc3f58.exe

    • Size

      2.1MB

    • MD5

      d9d0ba1c1cc0dd9243f36fba8b1147ad

    • SHA1

      eae15f17ee26ede826b934733e16762cd61c89fa

    • SHA256

      37f7dc1e5403ed4babd766ca88445f0c0fd555af19a5b669123660c262cc3f58

    • SHA512

      304503d20998426c25f8f12ff9907831e0184b5ac911a0ce45addec385cac82dc070a56ad8630b404a41023fb56140dda9498d8f1a659a77df2b944ebb6da6b9

    • SSDEEP

      6144:2TrjyPf1/pNLbtbTvspnI5p3YCmMuHrXOrfE8HiTAnnQUoJwS4LY5qhR:2TWBnjspnIb//XT7EAQPn4LJD

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks