Resubmissions

03-09-2024 15:08

240903-sh5p9s1enb 10

03-09-2024 14:31

240903-rvvkdsyhqq 10

General

  • Target

    DFDEE04A4FBC06E3D78886EB054D218B.exe

  • Size

    91KB

  • Sample

    240903-sh5p9s1enb

  • MD5

    dfdee04a4fbc06e3d78886eb054d218b

  • SHA1

    039f1436c0e7b06c1b24727b253e53ac02fbf459

  • SHA256

    6727531f7919f61fa1953ffbaf7e4067d4635b8123986c1ae2eeb4214ad99691

  • SHA512

    7368d0f2e4bfe6a3f129af464d0d9a93cfa77d2c0f519d9a557636aa9a99045f853ff2a2cbfb5ce24e6252f0274faec82e77752dab4737b7efb8e8e2d76f8d33

  • SSDEEP

    1536:MMLlP3vzovMndzhuv9qvvtT43g8iuzzLMFbxL2R5WXd1pAmcUQTk:MMLl8vId1vgIbbcR5WXd1pApQ

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

1

C2

164.92.232.138:9927

Mutex

GhaIV3XZwZIB

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      DFDEE04A4FBC06E3D78886EB054D218B.exe

    • Size

      91KB

    • MD5

      dfdee04a4fbc06e3d78886eb054d218b

    • SHA1

      039f1436c0e7b06c1b24727b253e53ac02fbf459

    • SHA256

      6727531f7919f61fa1953ffbaf7e4067d4635b8123986c1ae2eeb4214ad99691

    • SHA512

      7368d0f2e4bfe6a3f129af464d0d9a93cfa77d2c0f519d9a557636aa9a99045f853ff2a2cbfb5ce24e6252f0274faec82e77752dab4737b7efb8e8e2d76f8d33

    • SSDEEP

      1536:MMLlP3vzovMndzhuv9qvvtT43g8iuzzLMFbxL2R5WXd1pAmcUQTk:MMLl8vId1vgIbbcR5WXd1pApQ

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks