General

  • Target

    download

  • Size

    2KB

  • Sample

    240814-tlsesa1ckf

  • MD5

    7e35374ee66e34cbda7728dd0da4bf05

  • SHA1

    c28f6972fe927a6a60ab17faca26739908e15da1

  • SHA256

    b39759f17191cdb3a99558d1356cb855b86404e2574b60ed0c6d6289afdadc83

  • SHA512

    2b4b460d88eaa420209fc07b72055772d15e242bbb81139294c70e04784392744f2b1dec85d0cf590f336d18faf93747d3eac2fd08b08cf896248a3007ff9fbf

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://bitbucket.org/556ghfhgfhgf/fdsfdsf/downloads/dllhope.txt

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

lkkoi.duckdns.org:2020

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      download

    • Size

      2KB

    • MD5

      7e35374ee66e34cbda7728dd0da4bf05

    • SHA1

      c28f6972fe927a6a60ab17faca26739908e15da1

    • SHA256

      b39759f17191cdb3a99558d1356cb855b86404e2574b60ed0c6d6289afdadc83

    • SHA512

      2b4b460d88eaa420209fc07b72055772d15e242bbb81139294c70e04784392744f2b1dec85d0cf590f336d18faf93747d3eac2fd08b08cf896248a3007ff9fbf

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks