General

  • Target

    7d09f14e3053d887b4d7a44b1e90a7efd52b66d4aa8ca3f6a8a3c4b87f331ca3

  • Size

    3.6MB

  • Sample

    241123-zx8h2awpft

  • MD5

    2e63f2a5cebd089139f32b434c91115c

  • SHA1

    605916a5841886b87ead21b79128d9a78828095b

  • SHA256

    7d09f14e3053d887b4d7a44b1e90a7efd52b66d4aa8ca3f6a8a3c4b87f331ca3

  • SHA512

    d3a448690bd2ba62d7416eac23b8ae01738290ba40e1a4183534655e1d0d78792da26846ba5d4076851c71d883bb944b452f76896ae4918caa0d6831bd775e8f

  • SSDEEP

    98304:500i4fMjTHCmLccBWBlfRQibRNiFSWk5rR+F:3icISoWBV/2kWgrR+F

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

host.rorasama.top:63321

127.0.0.1:63321

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      7d09f14e3053d887b4d7a44b1e90a7efd52b66d4aa8ca3f6a8a3c4b87f331ca3

    • Size

      3.6MB

    • MD5

      2e63f2a5cebd089139f32b434c91115c

    • SHA1

      605916a5841886b87ead21b79128d9a78828095b

    • SHA256

      7d09f14e3053d887b4d7a44b1e90a7efd52b66d4aa8ca3f6a8a3c4b87f331ca3

    • SHA512

      d3a448690bd2ba62d7416eac23b8ae01738290ba40e1a4183534655e1d0d78792da26846ba5d4076851c71d883bb944b452f76896ae4918caa0d6831bd775e8f

    • SSDEEP

      98304:500i4fMjTHCmLccBWBlfRQibRNiFSWk5rR+F:3icISoWBV/2kWgrR+F

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix

Tasks