General

  • Target

    fd470c907b215324675a388082e85e7c7bd6ed5685b9c3b52839eecf16ef9ec6

  • Size

    154KB

  • Sample

    241012-tqb9csygng

  • MD5

    c6faf207d140df401de76c1eca8a82a4

  • SHA1

    e2c86698f4aaafb7a8c80803d9b582a53ffb9aea

  • SHA256

    fd470c907b215324675a388082e85e7c7bd6ed5685b9c3b52839eecf16ef9ec6

  • SHA512

    432e37a176fef6ed8ecaf97ba16c10d3bef06cc205435168017bbcccb991bd7971c1c9b2a893810609f53f001ca7e28b0b79e5bb761295362e5cd4063b34c466

  • SSDEEP

    3072:Gl+f1ul8jB09zdHCSMPWaIrqNGE6fAT8RbVIVpjrqNwX:GUbSrkWaI+NGZAT8RbVgJpX

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

xcrew1990.kozow.com:32400

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_file

    kreps1.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      fd470c907b215324675a388082e85e7c7bd6ed5685b9c3b52839eecf16ef9ec6

    • Size

      154KB

    • MD5

      c6faf207d140df401de76c1eca8a82a4

    • SHA1

      e2c86698f4aaafb7a8c80803d9b582a53ffb9aea

    • SHA256

      fd470c907b215324675a388082e85e7c7bd6ed5685b9c3b52839eecf16ef9ec6

    • SHA512

      432e37a176fef6ed8ecaf97ba16c10d3bef06cc205435168017bbcccb991bd7971c1c9b2a893810609f53f001ca7e28b0b79e5bb761295362e5cd4063b34c466

    • SSDEEP

      3072:Gl+f1ul8jB09zdHCSMPWaIrqNGE6fAT8RbVIVpjrqNwX:GUbSrkWaI+NGZAT8RbVgJpX

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks