General

  • Target

    coinbase.exe

  • Size

    74KB

  • Sample

    250119-he7qcaymgw

  • MD5

    77620fa13ab93f172c7c8d99d92c9fa2

  • SHA1

    8eee000da971276909d8b6e199702a9e965ded90

  • SHA256

    5618b4837d939e9b337cf5fb4f814d6aef001d9b0205ecd1193af26e8316ae0d

  • SHA512

    a3894a2ee7ae614748d12fb567cabec4aee28010d6d7211b690f0bd087141160373eee1bccafc3a2f878beabdbc928f3c9119cc6f6b41d22738e80ae4d7c7e18

  • SSDEEP

    1536:9UZGcx5NVCMoPMVDRMooK+kAIdH1b+/BUhCQzcBLVclN:9U8cx5zHoPMVDRPU+H1b+ZJQYBY

Malware Config

Extracted

Family

asyncrat

Version

Esco Private rat

Botnet

Default

C2

93.123.109.39:4449

Mutex

bcrikqwuktplgvg

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      coinbase.exe

    • Size

      74KB

    • MD5

      77620fa13ab93f172c7c8d99d92c9fa2

    • SHA1

      8eee000da971276909d8b6e199702a9e965ded90

    • SHA256

      5618b4837d939e9b337cf5fb4f814d6aef001d9b0205ecd1193af26e8316ae0d

    • SHA512

      a3894a2ee7ae614748d12fb567cabec4aee28010d6d7211b690f0bd087141160373eee1bccafc3a2f878beabdbc928f3c9119cc6f6b41d22738e80ae4d7c7e18

    • SSDEEP

      1536:9UZGcx5NVCMoPMVDRMooK+kAIdH1b+/BUhCQzcBLVclN:9U8cx5zHoPMVDRPU+H1b+ZJQYBY

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks