General
-
Target
2a2cb30aad7f963c02e030616945fcd0_JaffaCakes118
-
Size
45KB
-
Sample
241009-d9fswswcna
-
MD5
2a2cb30aad7f963c02e030616945fcd0
-
SHA1
3990931750e1415ad539fbb4c31c31f45847aba6
-
SHA256
a06b140ab8f1665d9dbacaa20da469622ce010c01a7fcef3b69121440bc3019c
-
SHA512
427237b92f4d56228dfbebb9b6a9a62d3848f2550179199bd3d33dad7c089a0a4c6607bf51224d8d93db971426a4fef3d5e7e2f3a7eff6d3332de074f2146c68
-
SSDEEP
768:quZPpT1Uu4/cWUeC66mo2q1MDEbHB8+OPI/TzjbXgX3iqSo50LBDZwx:quZPpT1tr2DyR3/T3bwXSqSocdwx
Malware Config
Extracted
asyncrat
0.5.7B
AUG
chongmei33.publicvm.com:2703
chongmei33.publicvm.com:49746
chongmei33.publicvm.com:46422
chongmei33.publicvm.com:6578
dongreg202020.duckdns.org:2703
dongreg202020.duckdns.org:49746
dongreg202020.duckdns.org:46422
dongreg202020.duckdns.org:6578
rahim321.duckdns.org:2703
rahim321.duckdns.org:49746
rahim321.duckdns.org:46422
rahim321.duckdns.org:6578
172.94.109.17:2703
172.94.109.17:49746
172.94.109.17:46422
172.94.109.17:6578
chonglee575.duckdns.org:2703
chonglee575.duckdns.org:49746
chonglee575.duckdns.org:46422
chonglee575.duckdns.org:6578
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
svchost.exe
-
install_folder
%Temp%
Targets
-
-
Target
2a2cb30aad7f963c02e030616945fcd0_JaffaCakes118
-
Size
45KB
-
MD5
2a2cb30aad7f963c02e030616945fcd0
-
SHA1
3990931750e1415ad539fbb4c31c31f45847aba6
-
SHA256
a06b140ab8f1665d9dbacaa20da469622ce010c01a7fcef3b69121440bc3019c
-
SHA512
427237b92f4d56228dfbebb9b6a9a62d3848f2550179199bd3d33dad7c089a0a4c6607bf51224d8d93db971426a4fef3d5e7e2f3a7eff6d3332de074f2146c68
-
SSDEEP
768:quZPpT1Uu4/cWUeC66mo2q1MDEbHB8+OPI/TzjbXgX3iqSo50LBDZwx:quZPpT1tr2DyR3/T3bwXSqSocdwx
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-