General

  • Target

    e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe

  • Size

    47KB

  • Sample

    241217-fwsawaspcp

  • MD5

    3e7ca285ef320886e388dc9097e1bf92

  • SHA1

    c2aaa30acb4c03e041aa5cca350c0095fa6d00f0

  • SHA256

    e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97

  • SHA512

    34266fb5685485010f076d0fec19ae538f27a9da1cccaf3454117480b7ebe83a612a52b44d651fa35897b237409cabf098ae69c9572f9932adf022f9eb894006

  • SSDEEP

    768:cuyJNTAoZjRWUJd9bmo2qLZYPILhlH2PVFf2PIR84WnZQe4bg24mQG76nRqw6zse:cuyJNTAGL2g32Pzf/R83QFbg2bH6RqJX

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

18.ip.gl.ply.gg:6606

18.ip.gl.ply.gg:7707

18.ip.gl.ply.gg:8808

18.ip.gl.ply.gg:9028

Mutex

HyFTucy74RnH

Attributes
  • delay

    3

  • install

    true

  • install_file

    Discord.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97.exe

    • Size

      47KB

    • MD5

      3e7ca285ef320886e388dc9097e1bf92

    • SHA1

      c2aaa30acb4c03e041aa5cca350c0095fa6d00f0

    • SHA256

      e9727d97d2b5f5953a05eaf69a1bdab54cc757955fbab97476d94a5af5920b97

    • SHA512

      34266fb5685485010f076d0fec19ae538f27a9da1cccaf3454117480b7ebe83a612a52b44d651fa35897b237409cabf098ae69c9572f9932adf022f9eb894006

    • SSDEEP

      768:cuyJNTAoZjRWUJd9bmo2qLZYPILhlH2PVFf2PIR84WnZQe4bg24mQG76nRqw6zse:cuyJNTAGL2g32Pzf/R83QFbg2bH6RqJX

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks