General

  • Target

    2e8cae53d7ce5f3fafc29ededea07d4eff4846d313ea643617cf3915e6400364

  • Size

    185KB

  • Sample

    240821-psw94asbmj

  • MD5

    1da76389e78dc3a690d28bcac45e70db

  • SHA1

    3d01440972092018bd1616616eb308a2c4fce952

  • SHA256

    2e8cae53d7ce5f3fafc29ededea07d4eff4846d313ea643617cf3915e6400364

  • SHA512

    ee06e2caf608a08df7bfb4886335932749e4a659ae6db22dd9341cf332bfa7d11183ae89997455e0764779e5e782f46befb6994062c2886cdec49448f9de87a3

  • SSDEEP

    3072:ImulTRjhYd3ZAc+qM+aaDjxXbU8Igw7lYc4XYf23GEhNIHsUl8Zp+mk:Imu7j+ZpMavFcgw6IOtLqsUlu5k

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

45.66.231.150:3232

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.mal_

    • Size

      331KB

    • MD5

      3a0a8189bb8910131bd13c098a1de18b

    • SHA1

      600ff8878e9782ff7d3df847b379eca20d3e3bdd

    • SHA256

      14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5

    • SHA512

      7c55c20d70f08b0c57390fc1decf1d26573c7e04738f1187e2ab3b8ecb0e3aebc06072f88724735828e114cad6592346c0c6b3a8db90c0b5765571fd5beefb6f

    • SSDEEP

      6144:o2x6R9b8D6InoSbfVmEtpMMlRMH9O1BNI:o46R9b87noWYapMMlRMo7I

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Async RAT payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

MITRE ATT&CK Enterprise v15

Tasks