General

  • Target

    b600ac504b0723a4862efd13a534375bbee4abd5c2ddd255daa031b21f788856N.exe

  • Size

    573KB

  • Sample

    241203-g55s1atkcs

  • MD5

    76ad663bb2554de5bf54d91dc07a47e0

  • SHA1

    700e8f09d9413705f13bd69fdc35e0c57240e8b0

  • SHA256

    b600ac504b0723a4862efd13a534375bbee4abd5c2ddd255daa031b21f788856

  • SHA512

    dd759d81d8b63d114d9c73379a557cd7929e74fc35f826af77f22461bcaa7060cbacdb8c10fb23dfce21a281f3a0b0bcb5ea6378511ca8a7983e5e00a5381c39

  • SSDEEP

    12288:gD+ImWu7YOwR+7Wq+kIN0xkGtxCtq30JCSHvi7o:gDKWu/w47WRoxkG7Cs30pi7

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:2035

147.185.221.16:2035

147.185.221.19:2035

121637121.duckdns.org:2035

Mutex

I8EJ82H739UG

Attributes
  • delay

    1

  • install

    true

  • install_file

    Update.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      b600ac504b0723a4862efd13a534375bbee4abd5c2ddd255daa031b21f788856N.exe

    • Size

      573KB

    • MD5

      76ad663bb2554de5bf54d91dc07a47e0

    • SHA1

      700e8f09d9413705f13bd69fdc35e0c57240e8b0

    • SHA256

      b600ac504b0723a4862efd13a534375bbee4abd5c2ddd255daa031b21f788856

    • SHA512

      dd759d81d8b63d114d9c73379a557cd7929e74fc35f826af77f22461bcaa7060cbacdb8c10fb23dfce21a281f3a0b0bcb5ea6378511ca8a7983e5e00a5381c39

    • SSDEEP

      12288:gD+ImWu7YOwR+7Wq+kIN0xkGtxCtq30JCSHvi7o:gDKWu/w47WRoxkG7Cs30pi7

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks