General

  • Target

    46ab2d0bce6511cf67cf931113da14de84304a4e9a814dbb8a88d0034e008ce7N

  • Size

    1.4MB

  • Sample

    241003-r5j7ea1arl

  • MD5

    8a34c7928d32b3ad2fb0836dec8f5350

  • SHA1

    5a1042858c92d1b3a98b26668474ad0d43798f95

  • SHA256

    46ab2d0bce6511cf67cf931113da14de84304a4e9a814dbb8a88d0034e008ce7

  • SHA512

    7d3f47e65fee77a2e5359b6edf401a3935ab48fb9c6721e7c2cc88db2e5e70aba3db97b5bfcc5c1ef369ac79d70cd0b170af4bf8af8b08017490c34fbf3e9ecf

  • SSDEEP

    24576:muDXTIGaPhEYzUzA0ukoIQto15dl9kYc5FDL6qwB0nGhPeXocXbotpNrUMAVfO8a:JDjlabwz9upIQtk5b9ZcWqwB0n2Wo+KX

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:4444

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      46ab2d0bce6511cf67cf931113da14de84304a4e9a814dbb8a88d0034e008ce7N

    • Size

      1.4MB

    • MD5

      8a34c7928d32b3ad2fb0836dec8f5350

    • SHA1

      5a1042858c92d1b3a98b26668474ad0d43798f95

    • SHA256

      46ab2d0bce6511cf67cf931113da14de84304a4e9a814dbb8a88d0034e008ce7

    • SHA512

      7d3f47e65fee77a2e5359b6edf401a3935ab48fb9c6721e7c2cc88db2e5e70aba3db97b5bfcc5c1ef369ac79d70cd0b170af4bf8af8b08017490c34fbf3e9ecf

    • SSDEEP

      24576:muDXTIGaPhEYzUzA0ukoIQto15dl9kYc5FDL6qwB0nGhPeXocXbotpNrUMAVfO8a:JDjlabwz9upIQtk5b9ZcWqwB0n2Wo+KX

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks