General

  • Target

    3efff01d7236dc49abf420b40c3460c89ffb3957933ba518dc5ad60d12261c35.ps1

  • Size

    182KB

  • Sample

    241210-c156rawkbm

  • MD5

    466bd5902510f9ad176108dd1c5f7979

  • SHA1

    586d8326df861aa4968495436a5e91beef85c585

  • SHA256

    3efff01d7236dc49abf420b40c3460c89ffb3957933ba518dc5ad60d12261c35

  • SHA512

    c2b1c10ad2bdb6f222e48e43f973e9c1c09ed66857b6e59cc2d06b26f71557d4cb5a840779633b8897fd4c37c1ab75226935e9c5d9de4e4ab2fddfa4fae93529

  • SSDEEP

    3072:4EEkBxJ3JygS3lX0ctuyHKCEIqQWVUBFJHFe730zz7F0ejBW/IeDFUJHFZuyEHB3:hv5ygS3hjtuyHKCEIqQWVUBFJHFe73N7

Malware Config

Extracted

Family

asyncrat

Version

A 13

Botnet

Default

C2

windows-cam.casacam.net:801

Mutex

AsyncMutex_6SI8OkPnkcvfg

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      3efff01d7236dc49abf420b40c3460c89ffb3957933ba518dc5ad60d12261c35.ps1

    • Size

      182KB

    • MD5

      466bd5902510f9ad176108dd1c5f7979

    • SHA1

      586d8326df861aa4968495436a5e91beef85c585

    • SHA256

      3efff01d7236dc49abf420b40c3460c89ffb3957933ba518dc5ad60d12261c35

    • SHA512

      c2b1c10ad2bdb6f222e48e43f973e9c1c09ed66857b6e59cc2d06b26f71557d4cb5a840779633b8897fd4c37c1ab75226935e9c5d9de4e4ab2fddfa4fae93529

    • SSDEEP

      3072:4EEkBxJ3JygS3lX0ctuyHKCEIqQWVUBFJHFe730zz7F0ejBW/IeDFUJHFZuyEHB3:hv5ygS3hjtuyHKCEIqQWVUBFJHFe73N7

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks