General

  • Target

    4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe

  • Size

    17KB

  • Sample

    241211-a62dmsxmcs

  • MD5

    5fc925dccc87a017afdeb282abcd15c0

  • SHA1

    37490c3d629bc7081082aca0422d2c45ed0520d3

  • SHA256

    4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7

  • SHA512

    6ce7ba920269c04ce52b39aae684ed6f70b7bec238c6098e47c64f9fc0a8712a0958faa546a59a207535a8dcd797594f5404a0766a3ce32cb59005e0513571e7

  • SSDEEP

    384:kEGfInKqgn7PiAniAAAeXWLMN8GuTM0sg7UAmm6+5qZMXBNTV76fA:kZfyU76AniAAAdJsCDXBNTpP

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

192.168.1.104:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe

    • Size

      17KB

    • MD5

      5fc925dccc87a017afdeb282abcd15c0

    • SHA1

      37490c3d629bc7081082aca0422d2c45ed0520d3

    • SHA256

      4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7

    • SHA512

      6ce7ba920269c04ce52b39aae684ed6f70b7bec238c6098e47c64f9fc0a8712a0958faa546a59a207535a8dcd797594f5404a0766a3ce32cb59005e0513571e7

    • SSDEEP

      384:kEGfInKqgn7PiAniAAAeXWLMN8GuTM0sg7UAmm6+5qZMXBNTV76fA:kZfyU76AniAAAdJsCDXBNTpP

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks