General

  • Target

    a3da0616ac4d01c59eec0cfd5594969def71f919a0bda2a2976334a3cc3c283dN.exe

  • Size

    47KB

  • Sample

    241231-brx84sxkcm

  • MD5

    d0f486c211c51e7968978c73a10020a0

  • SHA1

    8ef24e6079810505b323f056a471e9963c13e72a

  • SHA256

    a3da0616ac4d01c59eec0cfd5594969def71f919a0bda2a2976334a3cc3c283d

  • SHA512

    b99dd7fd987a76d664c41b5abe5b4b5a4bd6e711425eb5a9b464fcbb96da7e254112518c4d2c2f1199970138bd5cd87148e4233a01d379f2394acae28b9a20ed

  • SSDEEP

    768:EuXI1TAYhAVWU1LGvmo2q4KSETUvgcPI0qfiFps0bX/GVOl6krLKFOycBDZYx:EuXI1TAuP2q8K0qfAZbX/G8UL6dYx

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

147.185.221.24:40668

resolution-messages.gl.at.ply.gg:40668

Mutex

lzsTzjhhhJXe

Attributes
  • delay

    3

  • install

    true

  • install_file

    Windows Temporary Storage Helper.exe

  • install_folder

    %Temp%

aes.plain

Targets

    • Target

      a3da0616ac4d01c59eec0cfd5594969def71f919a0bda2a2976334a3cc3c283dN.exe

    • Size

      47KB

    • MD5

      d0f486c211c51e7968978c73a10020a0

    • SHA1

      8ef24e6079810505b323f056a471e9963c13e72a

    • SHA256

      a3da0616ac4d01c59eec0cfd5594969def71f919a0bda2a2976334a3cc3c283d

    • SHA512

      b99dd7fd987a76d664c41b5abe5b4b5a4bd6e711425eb5a9b464fcbb96da7e254112518c4d2c2f1199970138bd5cd87148e4233a01d379f2394acae28b9a20ed

    • SSDEEP

      768:EuXI1TAYhAVWU1LGvmo2q4KSETUvgcPI0qfiFps0bX/GVOl6krLKFOycBDZYx:EuXI1TAuP2q8K0qfAZbX/G8UL6dYx

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks