General

  • Target

    77D62A0F656D79E0FF5BB2F70E4E852C.exe

  • Size

    487KB

  • Sample

    241104-jrl5vazpbq

  • MD5

    77d62a0f656d79e0ff5bb2f70e4e852c

  • SHA1

    c85bde83456a07b3797aa6f290f71c8ff715a598

  • SHA256

    d7bfea7d65bd99597f52daaf771da4b372cd9426a6b082d3917f4b90a5294411

  • SHA512

    b503be45cc8d524d9f929aae53bc0a46e991c8db94503da64d3dfc1b1eaf7378c068da0156436fb865ad36016e957c7416a2e87bee3d1bb644e5c481a40bd645

  • SSDEEP

    12288:ctaDPw1Qk89TmyVryOUfR3rA9WgCqo3yrWE3I7Oqa8bfWT:c0Lw9gTFVryb3rkVCV+WE3FZ8bfW

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:1960

cuit.ydns.eu:1960

Mutex

Ym9duGjX2Yzz

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      77D62A0F656D79E0FF5BB2F70E4E852C.exe

    • Size

      487KB

    • MD5

      77d62a0f656d79e0ff5bb2f70e4e852c

    • SHA1

      c85bde83456a07b3797aa6f290f71c8ff715a598

    • SHA256

      d7bfea7d65bd99597f52daaf771da4b372cd9426a6b082d3917f4b90a5294411

    • SHA512

      b503be45cc8d524d9f929aae53bc0a46e991c8db94503da64d3dfc1b1eaf7378c068da0156436fb865ad36016e957c7416a2e87bee3d1bb644e5c481a40bd645

    • SSDEEP

      12288:ctaDPw1Qk89TmyVryOUfR3rA9WgCqo3yrWE3I7Oqa8bfWT:c0Lw9gTFVryb3rkVCV+WE3FZ8bfW

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks