Resubmissions

15/01/2025, 15:44

250115-s6kp1axjhs 10

15/01/2025, 14:52

250115-r81cssxlgr 10

15/01/2025, 14:49

250115-r7dseawjhs 10

General

  • Target

    Artifacts-2025-01-15_14-49-21Z.zip

  • Size

    5.9MB

  • Sample

    250115-s6kp1axjhs

  • MD5

    fff9376e98ece6e4bcb5950e8aea6ae2

  • SHA1

    d985c3a0f10a4fb3d13102bc15f59595b371bd84

  • SHA256

    d218b86a09b1154c146d9c897beff2b24ee4ed2448999ad9e08ec37ee0b8415f

  • SHA512

    6aec69bcdfb14b1a970d2be3e8a93d8c1d4a7bbe6bc2a6f94ad6e7864ab5fe5a2b11edb7202f62c31e12f50b0703acfcfac16da069032f4a2786d96ef6f0a65b

  • SSDEEP

    98304:5R9ALx8FrYlZtM/YDvTePMnyD7mUNgsNDxvyOPClz7pYHY+0M52Bp2NGb881Q2D9:53ox88uwDL6p7mogyZyOqh7pY47Mgp20

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

51.89.44.68:8848

Mutex

etb3t1tr5n

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %Temp%

aes.plain

Targets

    • Target

      Artifacts-2025-01-15_14-49-21Z.zip

    • Size

      5.9MB

    • MD5

      fff9376e98ece6e4bcb5950e8aea6ae2

    • SHA1

      d985c3a0f10a4fb3d13102bc15f59595b371bd84

    • SHA256

      d218b86a09b1154c146d9c897beff2b24ee4ed2448999ad9e08ec37ee0b8415f

    • SHA512

      6aec69bcdfb14b1a970d2be3e8a93d8c1d4a7bbe6bc2a6f94ad6e7864ab5fe5a2b11edb7202f62c31e12f50b0703acfcfac16da069032f4a2786d96ef6f0a65b

    • SSDEEP

      98304:5R9ALx8FrYlZtM/YDvTePMnyD7mUNgsNDxvyOPClz7pYHY+0M52Bp2NGb881Q2D9:53ox88uwDL6p7mogyZyOqh7pY47Mgp20

    Score
    3/10
    • Target

      e7d30fd97d59ed644b2344b8cf8e1d86531032474542f2bba1bc253cffcf5864.exe

    • Size

      6.1MB

    • MD5

      df8186565b9760042af7f12fb42a2de2

    • SHA1

      11311a96335df5237fa479716365bffd8004a103

    • SHA256

      e7d30fd97d59ed644b2344b8cf8e1d86531032474542f2bba1bc253cffcf5864

    • SHA512

      4f84deddf8d3290f7a8ed8cae7f571e04a2334b5ecae31b57f545099ec56d3f11fcea16dd5b190a69c203930a909ef7bf03536499c19c402693bc59f9dd3651f

    • SSDEEP

      196608:2SkSIlLTUcwti7TQl2NgVg01MWAXAkuujCPX9YG9he5GnQCAJKN:HkSopwtQQl2aOtXADu8X9Y95GQLJ

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks