General

  • Target

    SecuriteInfo.com.Win64.MalwareX-gen.27060.22350

  • Size

    29KB

  • Sample

    240930-bsat7szhrj

  • MD5

    e40eb702f369e5decfb33b3d78bd4b0c

  • SHA1

    3de25a909a7d8f20aaa4d9aba60aeb501c247f86

  • SHA256

    16a2abe3f4f2c005e206318caf37a366e0084fa8ca8561f3642fa0b4f2f04a7e

  • SHA512

    d015925072810f6ec5044ead32efc8ed6bee2d533c39915ceb526edce20edbc7fd3447423bd6ec608478eb87fdc70c9ad6dcce8b00b8328206adc9294137b60f

  • SSDEEP

    384:pWIooQkbZYGM0D4DTrMiRShFRDwSH3I6ELjTo0z2d6GHnGtI4qk9QlEM69+j5P0u:nQFGM0D4DKF9wHmhAvP9Ql369aR0

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

RuntimeBroker

C2

37.18.62.18:8060

Mutex

RuntimeBroker.exe

Attributes
  • delay

    1

  • install

    false

  • install_file

    RuntimeBroker.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      SecuriteInfo.com.Win64.MalwareX-gen.27060.22350

    • Size

      29KB

    • MD5

      e40eb702f369e5decfb33b3d78bd4b0c

    • SHA1

      3de25a909a7d8f20aaa4d9aba60aeb501c247f86

    • SHA256

      16a2abe3f4f2c005e206318caf37a366e0084fa8ca8561f3642fa0b4f2f04a7e

    • SHA512

      d015925072810f6ec5044ead32efc8ed6bee2d533c39915ceb526edce20edbc7fd3447423bd6ec608478eb87fdc70c9ad6dcce8b00b8328206adc9294137b60f

    • SSDEEP

      384:pWIooQkbZYGM0D4DTrMiRShFRDwSH3I6ELjTo0z2d6GHnGtI4qk9QlEM69+j5P0u:nQFGM0D4DKF9wHmhAvP9Ql369aR0

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks