General

  • Target

    1848-29-0x00000000030C0000-0x00000000030D6000-memory.dmp

  • Size

    88KB

  • Sample

    241104-mdc7kaygql

  • MD5

    ed93c7aff835f90c81282d8febb896e8

  • SHA1

    62744ab65e3757df86d4d04d756001113b683e80

  • SHA256

    6397e5d642a69c8c60b2abf81f6c27113546f1e1ee637f825d6c257defa9ff62

  • SHA512

    94a6f5cfb4604805f03ddf89943ef51559ce9f592407dcf559f13e84139cbf0a4dc9dcea29e9b99a59d6e3f7ed4af780edccc0ccf8b026d85e4e7de12c7d73bc

  • SSDEEP

    1536:G2ubUSvP3F0QlaZ8TqMKgKVNLzsIfkFEJkZs9TKdTy97AHa356dpt8qbD0Ll1LMP:G2ubUSvP3F0Q8yTqMKgKVNLzsIfkFEJe

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

Default

C2

51.222.21.24:6606

51.222.21.24:7707

51.222.21.24:8808

Mutex

AsyncMutex_alosh

Attributes
  • delay

    3

  • install

    false

  • install_file

    newbuild.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      1848-29-0x00000000030C0000-0x00000000030D6000-memory.dmp

    • Size

      88KB

    • MD5

      ed93c7aff835f90c81282d8febb896e8

    • SHA1

      62744ab65e3757df86d4d04d756001113b683e80

    • SHA256

      6397e5d642a69c8c60b2abf81f6c27113546f1e1ee637f825d6c257defa9ff62

    • SHA512

      94a6f5cfb4604805f03ddf89943ef51559ce9f592407dcf559f13e84139cbf0a4dc9dcea29e9b99a59d6e3f7ed4af780edccc0ccf8b026d85e4e7de12c7d73bc

    • SSDEEP

      1536:G2ubUSvP3F0QlaZ8TqMKgKVNLzsIfkFEJkZs9TKdTy97AHa356dpt8qbD0Ll1LMP:G2ubUSvP3F0Q8yTqMKgKVNLzsIfkFEJe

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks