General

  • Target

    3.exe

  • Size

    48KB

  • Sample

    241207-r4aatavqbw

  • MD5

    3d9e11f133404b0de3f4fd7e375e3fbf

  • SHA1

    1da48c172f95eb337a3b3427f6360d112abf907e

  • SHA256

    929bd74e00c56ec0935d5390a89dd4942abc1f3511a267034739fff0491e350b

  • SHA512

    77aa948b664f957851bb33d2276df7315d5f05abe912bed1214f6e37270a525799fb04cacd0e17a6c07fff55f96a32222ecf71fcf2104e71de153c64de8f147c

  • SSDEEP

    768:eVVFxILHtFp+BirI7Vf2ki6Y8Yb4gepge+6BvEgK/JYZVc6KN:eV27Eorzbvt6BnkJYZVclN

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

127.0.0.1:52039

dfsgmnhsrf23456623423456-52039.portmap.host:8848

dfsgmnhsrf23456623423456-52039.portmap.host:52039

Mutex

DcRatMutex_qwqdanchunxinsfd,mhbm gdfvg

Attributes
  • delay

    1

  • install

    true

  • install_file

    windows defender firewall required.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      3.exe

    • Size

      48KB

    • MD5

      3d9e11f133404b0de3f4fd7e375e3fbf

    • SHA1

      1da48c172f95eb337a3b3427f6360d112abf907e

    • SHA256

      929bd74e00c56ec0935d5390a89dd4942abc1f3511a267034739fff0491e350b

    • SHA512

      77aa948b664f957851bb33d2276df7315d5f05abe912bed1214f6e37270a525799fb04cacd0e17a6c07fff55f96a32222ecf71fcf2104e71de153c64de8f147c

    • SSDEEP

      768:eVVFxILHtFp+BirI7Vf2ki6Y8Yb4gepge+6BvEgK/JYZVc6KN:eV27Eorzbvt6BnkJYZVclN

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks