General

  • Target

    2025-01-23_14cc532e46d50345bf191c76eb0d6e48_frostygoop_snatch

  • Size

    2.6MB

  • Sample

    250123-rw7akssnht

  • MD5

    14cc532e46d50345bf191c76eb0d6e48

  • SHA1

    0c6e24ecfc80eedd64fbba2868e0a35fcc0d4fd3

  • SHA256

    915e0c43f108d6207a758d99bb5119b4b484cc5caec64df0e4e5367d8677691d

  • SHA512

    9ab2ab99e1dc2b4f27a3f66f52ff82267b269ea02e9b2fa8c6010a88e08a458d43071ff38ab7f80b0f3f572962d954bcec8c2bbc2af1318d22ee23f6c754d8a0

  • SSDEEP

    49152:/3/fwotL2tF6bYz1l7s/fD+yxQPhOgy5fp:/3HptytYos/fDRQpN6f

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

20.224.66.176:4784

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      2025-01-23_14cc532e46d50345bf191c76eb0d6e48_frostygoop_snatch

    • Size

      2.6MB

    • MD5

      14cc532e46d50345bf191c76eb0d6e48

    • SHA1

      0c6e24ecfc80eedd64fbba2868e0a35fcc0d4fd3

    • SHA256

      915e0c43f108d6207a758d99bb5119b4b484cc5caec64df0e4e5367d8677691d

    • SHA512

      9ab2ab99e1dc2b4f27a3f66f52ff82267b269ea02e9b2fa8c6010a88e08a458d43071ff38ab7f80b0f3f572962d954bcec8c2bbc2af1318d22ee23f6c754d8a0

    • SSDEEP

      49152:/3/fwotL2tF6bYz1l7s/fD+yxQPhOgy5fp:/3HptytYos/fDRQpN6f

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks