General

  • Target

    RuntimeBroker.exe

  • Size

    48KB

  • Sample

    250103-wthlnawpat

  • MD5

    f48dad5d1f222ffbad834e1735942077

  • SHA1

    450940def40ae8cf9b48e7fed829f43802f9a984

  • SHA256

    2039dfbccacc781852e958fd710d12dbd26586c379e97b192c82b0343ee25ae0

  • SHA512

    a8bd8fd998c71cd5291243808f2bafe2fbf65f4d62646fbdf775f66b650f628e8f675fb6b5a7ea2b287efcc457a90e8c1403717e9f5b30bce9136bf78b83e06d

  • SSDEEP

    768:Ru+01TQQEX1WUVt1Pmo2qjRx7u4vfW+0yD0b6nIkrTN4+djyP6a8T317oSkcDZ22:Ru+01TQfb2kv++0db6nXa8ySaYBbd2P+

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

impact-leeds.gl.at.ply.gg:44574

Mutex

rSqd9NDbOdBy

Attributes
  • delay

    3

  • install

    true

  • install_file

    RuntimeBroker.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      RuntimeBroker.exe

    • Size

      48KB

    • MD5

      f48dad5d1f222ffbad834e1735942077

    • SHA1

      450940def40ae8cf9b48e7fed829f43802f9a984

    • SHA256

      2039dfbccacc781852e958fd710d12dbd26586c379e97b192c82b0343ee25ae0

    • SHA512

      a8bd8fd998c71cd5291243808f2bafe2fbf65f4d62646fbdf775f66b650f628e8f675fb6b5a7ea2b287efcc457a90e8c1403717e9f5b30bce9136bf78b83e06d

    • SSDEEP

      768:Ru+01TQQEX1WUVt1Pmo2qjRx7u4vfW+0yD0b6nIkrTN4+djyP6a8T317oSkcDZ22:Ru+01TQfb2kv++0db6nXa8ySaYBbd2P+

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks