General

  • Target

    upload.config.exe

  • Size

    9.8MB

  • Sample

    241224-x8wx9svmgs

  • MD5

    7a1eaa75ff1d1e83f564d0e5312a0930

  • SHA1

    91988fcd3ffe2945d614f2141e0124f9ebcd6e01

  • SHA256

    de47ee6f5098830b2569a1f0f889e021a9be2604093e3e157852060d307aa9f2

  • SHA512

    b1d06ffc724e7a393387fb84900af0badf3a84bfe3ea0b2bed27d41f3114586e7b25b9661c2f23476b51b6cf9d5dcb36cf1d807c5441909b2a8315e4d40cc8c7

  • SSDEEP

    49152:Plnb9f3/00iPuJXm6Os/CTu9VnAaZ+6AmX9mQXd0ujFFoyS+km9nmgMfq9+s6ewR:NnF00iPu

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

jt8iyre.localto.net:2101

jt8iyre.localto.net:55644

Mutex

AbAUwI3PK3e3

Attributes
  • delay

    3

  • install

    false

  • install_file

    winserve.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      upload.config.exe

    • Size

      9.8MB

    • MD5

      7a1eaa75ff1d1e83f564d0e5312a0930

    • SHA1

      91988fcd3ffe2945d614f2141e0124f9ebcd6e01

    • SHA256

      de47ee6f5098830b2569a1f0f889e021a9be2604093e3e157852060d307aa9f2

    • SHA512

      b1d06ffc724e7a393387fb84900af0badf3a84bfe3ea0b2bed27d41f3114586e7b25b9661c2f23476b51b6cf9d5dcb36cf1d807c5441909b2a8315e4d40cc8c7

    • SSDEEP

      49152:Plnb9f3/00iPuJXm6Os/CTu9VnAaZ+6AmX9mQXd0ujFFoyS+km9nmgMfq9+s6ewR:NnF00iPu

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks