General

  • Target

    Client.exe

  • Size

    45KB

  • Sample

    250111-sklp6ssjgy

  • MD5

    b6811a1daca8cfda16da0f730c174133

  • SHA1

    92d67d3836def51f5a45389692292b2998a0c559

  • SHA256

    d5619e740a38ee0c894dd17051419306c4b35ad55a1558854ed82527a4aa736c

  • SHA512

    c1fe4b8edc38eef9ce12ae56f7874690b50519b12560620766c7e0b9f6a8cf1f9d00f648f6fa15b328320435e013bccae2dd2195985d8121ffc3c16b521b857d

  • SSDEEP

    768:9ujY21TUET1/WUT1V9mo2qz4KjPGaG6PIyzjbFgX3iaIqH5jdrK9APGuU2BDZzx:9ujY21TU0r21KTkDy3bCXSeHrKqPfdzx

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

0.tcp.in.ngrok.io:10147

Mutex

Q52IWD1RYgpZ

Attributes
  • delay

    3

  • install

    false

  • install_file

    Listopener.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Client.exe

    • Size

      45KB

    • MD5

      b6811a1daca8cfda16da0f730c174133

    • SHA1

      92d67d3836def51f5a45389692292b2998a0c559

    • SHA256

      d5619e740a38ee0c894dd17051419306c4b35ad55a1558854ed82527a4aa736c

    • SHA512

      c1fe4b8edc38eef9ce12ae56f7874690b50519b12560620766c7e0b9f6a8cf1f9d00f648f6fa15b328320435e013bccae2dd2195985d8121ffc3c16b521b857d

    • SSDEEP

      768:9ujY21TUET1/WUT1V9mo2qz4KjPGaG6PIyzjbFgX3iaIqH5jdrK9APGuU2BDZzx:9ujY21TU0r21KTkDy3bCXSeHrKqPfdzx

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks