General

  • Target

    4e96241248a8f9b7304190d21a081afb646f432d1ffbd3fbab7207515313fdd7.exe

  • Size

    2.0MB

  • Sample

    240816-bh65nawfrc

  • MD5

    b4a77cea5a03f4a34f8d5640cebd44ac

  • SHA1

    cff95695ce0d401135206f3a7dda81b91d3c6b1e

  • SHA256

    4e96241248a8f9b7304190d21a081afb646f432d1ffbd3fbab7207515313fdd7

  • SHA512

    3b5e2edcc9d9be7f141d42e4dc67405d6bf6f6b423f6d18c4090bf46d421dda8743a4fec3599a1fcb8813ed3f1b4d514864741bc50c13fd183b42fa71a51f5fe

  • SSDEEP

    49152:GZd4ryFkp8Y4N1Pq3FKHv6T0x5E/aHJEt050R:G7qrpddVBTBR

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

AMU

C2

jnmanymen.ydns.eu:1470

Mutex

zVHQMfZojR9k

Attributes
  • delay

    10

  • install

    true

  • install_file

    windows.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      4e96241248a8f9b7304190d21a081afb646f432d1ffbd3fbab7207515313fdd7.exe

    • Size

      2.0MB

    • MD5

      b4a77cea5a03f4a34f8d5640cebd44ac

    • SHA1

      cff95695ce0d401135206f3a7dda81b91d3c6b1e

    • SHA256

      4e96241248a8f9b7304190d21a081afb646f432d1ffbd3fbab7207515313fdd7

    • SHA512

      3b5e2edcc9d9be7f141d42e4dc67405d6bf6f6b423f6d18c4090bf46d421dda8743a4fec3599a1fcb8813ed3f1b4d514864741bc50c13fd183b42fa71a51f5fe

    • SSDEEP

      49152:GZd4ryFkp8Y4N1Pq3FKHv6T0x5E/aHJEt050R:G7qrpddVBTBR

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks