General

  • Target

    https://download2260.mediafire.com/vfc16k1j76cg-05mlnYAO86eEb6K_jwoe5e8DC8Tli8q93uKnPdGcIdokOO1kWet1mlJWYHH1tyr7OwxOi2UQqedzM7K1C4nHrC7F152NVcUGbXYnbjY-pIRlaLJLVTQyM6PMLewcqg_EB57MPP0dBwMAFd4FbKnGEFWn5lAsAGP/kakpwo2ho51pi0i/munchenlatest.zip

  • Sample

    241103-2jbm9awfja

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Guppies

C2

198.98.58.93:999

Mutex

SYSTEMSPOOF

Attributes
  • delay

    1

  • install

    true

  • install_file

    Core Sound Service.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      https://download2260.mediafire.com/vfc16k1j76cg-05mlnYAO86eEb6K_jwoe5e8DC8Tli8q93uKnPdGcIdokOO1kWet1mlJWYHH1tyr7OwxOi2UQqedzM7K1C4nHrC7F152NVcUGbXYnbjY-pIRlaLJLVTQyM6PMLewcqg_EB57MPP0dBwMAFd4FbKnGEFWn5lAsAGP/kakpwo2ho51pi0i/munchenlatest.zip

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks