General

  • Target

    39ed2e526804c859de3d0d593bf595209b25563da279979a2915ba348f9d6e47

  • Size

    3.0MB

  • Sample

    250116-vfglrszlax

  • MD5

    4297b6b6da978bbe22296c3f900a75bc

  • SHA1

    c959b9572cf21338829e9e8ed7430c9d44278088

  • SHA256

    39ed2e526804c859de3d0d593bf595209b25563da279979a2915ba348f9d6e47

  • SHA512

    0fda8579b29a6d8a6bec4026cb80fc88bdedb787c8f7269c6f023da4e8841a770d46729fdb54d7380893deadff279471c8fc3a1370ae94a9a9b3ccd731be30f5

  • SSDEEP

    24576:i7w6F3CXC3UaEAbeJGOvSCspptIw+Sg0gp6WDCXC3lram7Xu1pPyYw6En6wWLf3e:i7uIbtCaIw+SgppdaC+1RyY8n

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

2025-DYNU-16

C2

2201.mysynology.net:8329

2201.mysynology.net:2201

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      39ed2e526804c859de3d0d593bf595209b25563da279979a2915ba348f9d6e47

    • Size

      3.0MB

    • MD5

      4297b6b6da978bbe22296c3f900a75bc

    • SHA1

      c959b9572cf21338829e9e8ed7430c9d44278088

    • SHA256

      39ed2e526804c859de3d0d593bf595209b25563da279979a2915ba348f9d6e47

    • SHA512

      0fda8579b29a6d8a6bec4026cb80fc88bdedb787c8f7269c6f023da4e8841a770d46729fdb54d7380893deadff279471c8fc3a1370ae94a9a9b3ccd731be30f5

    • SSDEEP

      24576:i7w6F3CXC3UaEAbeJGOvSCspptIw+Sg0gp6WDCXC3lram7Xu1pPyYw6En6wWLf3e:i7uIbtCaIw+SgppdaC+1RyY8n

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks