General

  • Target

    Api-AutoUpdater.exe

  • Size

    63KB

  • Sample

    241116-wtzvyazpez

  • MD5

    3a7e15932c71fd6a0549c01504d38c1b

  • SHA1

    f3ec3762b11cc984aaf6d2b1ebbf0ecd639ead21

  • SHA256

    af5b47951de18f9979f68163abb1dff919b1af9c0a6a44d664f49cdbc14f1a41

  • SHA512

    033f730ec422a60d1c345566b32a60a6c1bfda2d2419f80e523e59515a01c2e11ebc99e6eb61ead9f15767c666976082022c4e1628a6cc4d01b429d2ec19c641

  • SSDEEP

    1536:TeQPczZ9d84YUbAheLLEIhcZvGucdpqKmY7:TeDzZ9d9YUbAQLEIhuEGz

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

previous-casual.gl.at.ply.gg:42435

Attributes
  • delay

    1

  • install

    true

  • install_file

    Windows.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Api-AutoUpdater.exe

    • Size

      63KB

    • MD5

      3a7e15932c71fd6a0549c01504d38c1b

    • SHA1

      f3ec3762b11cc984aaf6d2b1ebbf0ecd639ead21

    • SHA256

      af5b47951de18f9979f68163abb1dff919b1af9c0a6a44d664f49cdbc14f1a41

    • SHA512

      033f730ec422a60d1c345566b32a60a6c1bfda2d2419f80e523e59515a01c2e11ebc99e6eb61ead9f15767c666976082022c4e1628a6cc4d01b429d2ec19c641

    • SSDEEP

      1536:TeQPczZ9d84YUbAheLLEIhcZvGucdpqKmY7:TeDzZ9d9YUbAQLEIhuEGz

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks