General

  • Target

    55DC02E0FCF4ABD882B9A072360950B27D4C9165D1BE68E976FFE7654F529E08.exe

  • Size

    63KB

  • Sample

    241204-18gp5azmhp

  • MD5

    0af17fe613832c7452a76cf8df24cfeb

  • SHA1

    f70c8b3a7bbc1fb1ad826addc2be57212244d82c

  • SHA256

    55dc02e0fcf4abd882b9a072360950b27d4c9165d1be68e976ffe7654f529e08

  • SHA512

    474a5212f17e36c1584a1b53860312aa76cd5c053ac4e231e781a79107ff3681f4cdc8f13c612e5f91d5564339af18b29c7937464b41e1f2120d81fca4ed558e

  • SSDEEP

    1536:OmfW6qHdykrVMKuJUYFOGXw5bfAPxayXliSrPlTGJx:Ome6qHdykGKuJUYFOGXw5bfoa0xdSx

Malware Config

Extracted

Family

asyncrat

Version

AWS | RxR

Botnet

ali01

C2

okokay.duckdns.org:6606

okokay.duckdns.org:7707

okokay.duckdns.org:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      55DC02E0FCF4ABD882B9A072360950B27D4C9165D1BE68E976FFE7654F529E08.exe

    • Size

      63KB

    • MD5

      0af17fe613832c7452a76cf8df24cfeb

    • SHA1

      f70c8b3a7bbc1fb1ad826addc2be57212244d82c

    • SHA256

      55dc02e0fcf4abd882b9a072360950b27d4c9165d1be68e976ffe7654f529e08

    • SHA512

      474a5212f17e36c1584a1b53860312aa76cd5c053ac4e231e781a79107ff3681f4cdc8f13c612e5f91d5564339af18b29c7937464b41e1f2120d81fca4ed558e

    • SSDEEP

      1536:OmfW6qHdykrVMKuJUYFOGXw5bfAPxayXliSrPlTGJx:Ome6qHdykGKuJUYFOGXw5bfoa0xdSx

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks