General

  • Target

    a5ef9edcea30f251660ee2126b07d5b9ec416a9b3dbecb4ce84206e75271506f

  • Size

    3.1MB

  • Sample

    250116-zvpm5szkgj

  • MD5

    ed9f57a7b0f31b5a7f5c3662f82f2965

  • SHA1

    04bd78f04abe3315ef26446ab01519e973ec0b8b

  • SHA256

    a5ef9edcea30f251660ee2126b07d5b9ec416a9b3dbecb4ce84206e75271506f

  • SHA512

    bca1118ee6a8b72212c0e93240441048a7fa72c52f308b695bf98f5bba4b140dd6be7ed7fe3d84591b1e43c2348086aff37e9967a837099e32ad9dc93ae542f1

  • SSDEEP

    49152:EGaTIbtCaIw+SgS9Xei/uNVz0aC+1RAeQK:zQCNZajvAeQK

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

85.31.47.59:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      a5ef9edcea30f251660ee2126b07d5b9ec416a9b3dbecb4ce84206e75271506f

    • Size

      3.1MB

    • MD5

      ed9f57a7b0f31b5a7f5c3662f82f2965

    • SHA1

      04bd78f04abe3315ef26446ab01519e973ec0b8b

    • SHA256

      a5ef9edcea30f251660ee2126b07d5b9ec416a9b3dbecb4ce84206e75271506f

    • SHA512

      bca1118ee6a8b72212c0e93240441048a7fa72c52f308b695bf98f5bba4b140dd6be7ed7fe3d84591b1e43c2348086aff37e9967a837099e32ad9dc93ae542f1

    • SSDEEP

      49152:EGaTIbtCaIw+SgS9Xei/uNVz0aC+1RAeQK:zQCNZajvAeQK

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks