General

  • Target

    AsyncClient.exe

  • Size

    47KB

  • Sample

    241214-rbbm6stqc1

  • MD5

    f826bed80bd47afaae707ca60525087d

  • SHA1

    cfc70fd56b4114cf146406a4ebbbfba25e5e97f0

  • SHA256

    a58f4b7cff7b27cd1565c85f638071671cfe7fe40a162a365ad18512488dfb4d

  • SHA512

    aa0ab0511fce8f520b7a501c15b673638cdaa1bd2d1e9e36e5c5b66d44fce62a67a02465c74edfdec88b2fd1727d1ed78c3200d410a88e9f75698028de848b01

  • SSDEEP

    768:tuTAlTP3IwK2WUwv2Mmo2qBIWRoXXPILBO1d+iv0bI/1s+I06boqtmsvwO9lBDZZ:tuTAlTPrg2AoALkMbI/1OrMqtZDdvx

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

A5dbA4ZoyZMW

Attributes
  • delay

    3

  • install

    true

  • install_file

    helloo.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      AsyncClient.exe

    • Size

      47KB

    • MD5

      f826bed80bd47afaae707ca60525087d

    • SHA1

      cfc70fd56b4114cf146406a4ebbbfba25e5e97f0

    • SHA256

      a58f4b7cff7b27cd1565c85f638071671cfe7fe40a162a365ad18512488dfb4d

    • SHA512

      aa0ab0511fce8f520b7a501c15b673638cdaa1bd2d1e9e36e5c5b66d44fce62a67a02465c74edfdec88b2fd1727d1ed78c3200d410a88e9f75698028de848b01

    • SSDEEP

      768:tuTAlTP3IwK2WUwv2Mmo2qBIWRoXXPILBO1d+iv0bI/1s+I06boqtmsvwO9lBDZZ:tuTAlTPrg2AoALkMbI/1OrMqtZDdvx

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks