General

  • Target

    3a4dc784a93e7ee7cf96790ba40b4304384c21d3811c2960d2886e823b22eb82.exe

  • Size

    63KB

  • Sample

    250120-ewd8ks1jet

  • MD5

    a587ed228c608a71f06edbc8e8e087e9

  • SHA1

    e9e4b0d19b8139a6b8bb63ddee6422ba63648824

  • SHA256

    3a4dc784a93e7ee7cf96790ba40b4304384c21d3811c2960d2886e823b22eb82

  • SHA512

    b76ff1c062d4e1fd9b217661204b82a3898bfbe9ea2b4287e8e5aa28c1ca19f913f1d2c390d5dff1051dae9e6b2f5bf2c2a7886e1f112f00c25619c11c16529e

  • SSDEEP

    768:cILZTnPRs78HIC8A+XnJkUeXIkhuuAi1+T4bSBGHmDbDCph0oiHJ7oHQSu8dpqKX:pRRQZbgpkYUbshIHJoXu8dpqKmY7

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

147.185.221.24:18545

Attributes
  • delay

    1

  • install

    true

  • install_file

    xrat.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      3a4dc784a93e7ee7cf96790ba40b4304384c21d3811c2960d2886e823b22eb82.exe

    • Size

      63KB

    • MD5

      a587ed228c608a71f06edbc8e8e087e9

    • SHA1

      e9e4b0d19b8139a6b8bb63ddee6422ba63648824

    • SHA256

      3a4dc784a93e7ee7cf96790ba40b4304384c21d3811c2960d2886e823b22eb82

    • SHA512

      b76ff1c062d4e1fd9b217661204b82a3898bfbe9ea2b4287e8e5aa28c1ca19f913f1d2c390d5dff1051dae9e6b2f5bf2c2a7886e1f112f00c25619c11c16529e

    • SSDEEP

      768:cILZTnPRs78HIC8A+XnJkUeXIkhuuAi1+T4bSBGHmDbDCph0oiHJ7oHQSu8dpqKX:pRRQZbgpkYUbshIHJoXu8dpqKmY7

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks