General

  • Target

    ae8a9e172bccbe1f002771f0142ed8811e2e7047301ac366e356b33762c34f8eN.exe

  • Size

    1.1MB

  • Sample

    241120-dwwxyszapb

  • MD5

    bfa2bc658d2270623baf2069bac872d0

  • SHA1

    af61ae30d446da19a74294c367eb16a51b11cd48

  • SHA256

    ae8a9e172bccbe1f002771f0142ed8811e2e7047301ac366e356b33762c34f8e

  • SHA512

    ee40e1e2349b650ef9b8b4c27d3f37b6912332e8d7c6cb94ac9150cb2273701573fa8ad8052ae20cbf1eb2bc40dcca579b6bd174f2b1ca12f73ad1cb160d7180

  • SSDEEP

    24576:8h2a3r7h4ZhmJZUC21Mkr1zs8/KotC0mJhlTWX:6mZ+SFpFsIRbX

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

PESCA

C2

pesca12.duckdns.org:7707

pesca12.duckdns.org:6606

Mutex

uuooxuxbnkywum

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ae8a9e172bccbe1f002771f0142ed8811e2e7047301ac366e356b33762c34f8eN.exe

    • Size

      1.1MB

    • MD5

      bfa2bc658d2270623baf2069bac872d0

    • SHA1

      af61ae30d446da19a74294c367eb16a51b11cd48

    • SHA256

      ae8a9e172bccbe1f002771f0142ed8811e2e7047301ac366e356b33762c34f8e

    • SHA512

      ee40e1e2349b650ef9b8b4c27d3f37b6912332e8d7c6cb94ac9150cb2273701573fa8ad8052ae20cbf1eb2bc40dcca579b6bd174f2b1ca12f73ad1cb160d7180

    • SSDEEP

      24576:8h2a3r7h4ZhmJZUC21Mkr1zs8/KotC0mJhlTWX:6mZ+SFpFsIRbX

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks