General

  • Target

    755b652523d03387343a68bfd7bbcad75e93bbe668aadedae927ab1980a05d0a.exe

  • Size

    859KB

  • Sample

    241006-bmjvxsshlf

  • MD5

    19c25248c2ebe60a5da4ac7ce7c5eda8

  • SHA1

    d7eb8a9c151f1d3488a1fa4e271e00912c98a0c9

  • SHA256

    755b652523d03387343a68bfd7bbcad75e93bbe668aadedae927ab1980a05d0a

  • SHA512

    3bdfc6e0cb33ff6858abfd945c374a48a66b14f0d2e2530e7a6ee2f7e7969aaac80f0fb5b768310844d70f79d2c9c6234e5731c489301b6272e4ad1624baad02

  • SSDEEP

    12288:b5+N/wAkwJHS2fPehzY2ScrfM/40yb/bzbiLTcRfVtZ2mE+92Wl7u16wI3arYx:lY2wkacr0/40yb/UG7r2+u16V3a8

Malware Config

Extracted

Family

asyncrat

Version

AWS | RxR

Botnet

Connector

C2

51.38.109.144:6606

51.38.109.144:7707

51.38.109.144:8808

Mutex

AsyncMutex_VConnector

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      755b652523d03387343a68bfd7bbcad75e93bbe668aadedae927ab1980a05d0a.exe

    • Size

      859KB

    • MD5

      19c25248c2ebe60a5da4ac7ce7c5eda8

    • SHA1

      d7eb8a9c151f1d3488a1fa4e271e00912c98a0c9

    • SHA256

      755b652523d03387343a68bfd7bbcad75e93bbe668aadedae927ab1980a05d0a

    • SHA512

      3bdfc6e0cb33ff6858abfd945c374a48a66b14f0d2e2530e7a6ee2f7e7969aaac80f0fb5b768310844d70f79d2c9c6234e5731c489301b6272e4ad1624baad02

    • SSDEEP

      12288:b5+N/wAkwJHS2fPehzY2ScrfM/40yb/bzbiLTcRfVtZ2mE+92Wl7u16wI3arYx:lY2wkacr0/40yb/UG7r2+u16V3a8

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks