General

  • Target

    BotKiller.exe

  • Size

    6KB

  • Sample

    241126-3qvv5swjbz

  • MD5

    10d199b2efdb69ed343f5cd4044b7def

  • SHA1

    1f218983db04d9b7b31a67aeead5a94ca5d3dc80

  • SHA256

    5fbd4e2c42e19e7ee561183ca6b2ded2f8049a890951704c799e8b4a016ab817

  • SHA512

    682feb271c12a847b69f1ac92ad7d5cad18b145b64af83dbe7fd0f6282be8bf6091323ca16bc509f789a68e74e17eb1484fce907f9a0562237b40572e0e8852c

  • SSDEEP

    96:1SJmM+BVOGjYKyhp+Aloz0yD/TB2uJW9wzNt:1smHOhpdXyLEuJIS

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

technical-southwest.gl.at.ply.gg:58694

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      BotKiller.exe

    • Size

      6KB

    • MD5

      10d199b2efdb69ed343f5cd4044b7def

    • SHA1

      1f218983db04d9b7b31a67aeead5a94ca5d3dc80

    • SHA256

      5fbd4e2c42e19e7ee561183ca6b2ded2f8049a890951704c799e8b4a016ab817

    • SHA512

      682feb271c12a847b69f1ac92ad7d5cad18b145b64af83dbe7fd0f6282be8bf6091323ca16bc509f789a68e74e17eb1484fce907f9a0562237b40572e0e8852c

    • SSDEEP

      96:1SJmM+BVOGjYKyhp+Aloz0yD/TB2uJW9wzNt:1smHOhpdXyLEuJIS

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks