General

  • Target

    d6ac33bdde804937341f6ac88e9f03c5738df8037df6184b2c14e848e6222a98

  • Size

    74KB

  • Sample

    240818-xqrwlasdqm

  • MD5

    aa89ed1bd7a09a03da6bef9ae0143509

  • SHA1

    35a6f79a5ed45ad4b6682daca1b77b6355b9c6f9

  • SHA256

    d6ac33bdde804937341f6ac88e9f03c5738df8037df6184b2c14e848e6222a98

  • SHA512

    1e610419ded5dc49711d80feda97b7d2ff7fb71805acfaec004f8bfa4942130af869b17b1e8a3db121338588aa1d0f6a69d302d0661bdd0c20d9553e80e878f3

  • SSDEEP

    1536:CUlkcx9pXCTyPMVt53pIZlOH1bW/Wab0XWQQzciLVclN:CU+cx958yPMVHslOH1bWp8PQzBY

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

15.229.43.98:7771

Mutex

piikvzefolbyasuv

Attributes
  • delay

    1

  • install

    true

  • install_file

    digital.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      d6ac33bdde804937341f6ac88e9f03c5738df8037df6184b2c14e848e6222a98

    • Size

      74KB

    • MD5

      aa89ed1bd7a09a03da6bef9ae0143509

    • SHA1

      35a6f79a5ed45ad4b6682daca1b77b6355b9c6f9

    • SHA256

      d6ac33bdde804937341f6ac88e9f03c5738df8037df6184b2c14e848e6222a98

    • SHA512

      1e610419ded5dc49711d80feda97b7d2ff7fb71805acfaec004f8bfa4942130af869b17b1e8a3db121338588aa1d0f6a69d302d0661bdd0c20d9553e80e878f3

    • SSDEEP

      1536:CUlkcx9pXCTyPMVt53pIZlOH1bW/Wab0XWQQzciLVclN:CU+cx958yPMVHslOH1bWp8PQzBY

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • VenomRAT

      Detects VenomRAT.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks