General

  • Target

    7300c7b0a478fe6da9bf95c90630f0bb712127e52e99aaad889428a2de1fbc5f

  • Size

    1.7MB

  • Sample

    240818-xgdyda1hlj

  • MD5

    4617174e6053cbec25e7c18bace5d231

  • SHA1

    5ebef0ad6997b7948ca30057b64a0c7687b25d33

  • SHA256

    7300c7b0a478fe6da9bf95c90630f0bb712127e52e99aaad889428a2de1fbc5f

  • SHA512

    cc405d0798d437ca7ab5d6fe0c09b726e5ae16057e20f8f83d54633b17993387a6bd353c390129c1f546e11d40d1296ec21135e5b7f9baeedc2e928e3f9fd57f

  • SSDEEP

    24576:tXKRZcz+jlc4ibwDQMfUU4EzR5TZ+4QFZ3mBuETqyQN7RsHXdsjszjUxov7tTX:QS+Xl4aRn+xVaqyQNaNsgbv7FX

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

allay.x3322.net:5050

Mutex

gnrfjlujxmukjuvrs

Attributes
  • delay

    1

  • install

    true

  • install_file

    WriteFile.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      7300c7b0a478fe6da9bf95c90630f0bb712127e52e99aaad889428a2de1fbc5f

    • Size

      1.7MB

    • MD5

      4617174e6053cbec25e7c18bace5d231

    • SHA1

      5ebef0ad6997b7948ca30057b64a0c7687b25d33

    • SHA256

      7300c7b0a478fe6da9bf95c90630f0bb712127e52e99aaad889428a2de1fbc5f

    • SHA512

      cc405d0798d437ca7ab5d6fe0c09b726e5ae16057e20f8f83d54633b17993387a6bd353c390129c1f546e11d40d1296ec21135e5b7f9baeedc2e928e3f9fd57f

    • SSDEEP

      24576:tXKRZcz+jlc4ibwDQMfUU4EzR5TZ+4QFZ3mBuETqyQN7RsHXdsjszjUxov7tTX:QS+Xl4aRn+xVaqyQNaNsgbv7FX

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • VenomRAT

      Detects VenomRAT.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks