General

  • Target

    4173877efb088a4c67894f89c2c572611f5336923e9719fd8a0b06adad909454.exe

  • Size

    64KB

  • Sample

    250111-c2jddazjhx

  • MD5

    254a11f9d435208efa20459c281ed8c2

  • SHA1

    895bc765576d8c9d6f45a0076ebf4bbc82819c23

  • SHA256

    4173877efb088a4c67894f89c2c572611f5336923e9719fd8a0b06adad909454

  • SHA512

    8efa0cb8fd0c3b56f83d7204651fd9db9e706010ad3debddffe83d3e01355379add35267aa27fdba766b07270a3925cf981c56ecac4cc429c1008618958ff0a2

  • SSDEEP

    1536:LAnX35lynODDRtC8fJcXT0/iBlYqbVPP5feFGckOggakAX7tj:05COXmYJcXYalYUH5GFIOHAX7tj

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

oeSQUd5RFk09

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      4173877efb088a4c67894f89c2c572611f5336923e9719fd8a0b06adad909454.exe

    • Size

      64KB

    • MD5

      254a11f9d435208efa20459c281ed8c2

    • SHA1

      895bc765576d8c9d6f45a0076ebf4bbc82819c23

    • SHA256

      4173877efb088a4c67894f89c2c572611f5336923e9719fd8a0b06adad909454

    • SHA512

      8efa0cb8fd0c3b56f83d7204651fd9db9e706010ad3debddffe83d3e01355379add35267aa27fdba766b07270a3925cf981c56ecac4cc429c1008618958ff0a2

    • SSDEEP

      1536:LAnX35lynODDRtC8fJcXT0/iBlYqbVPP5feFGckOggakAX7tj:05COXmYJcXYalYUH5GFIOHAX7tj

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks