General

  • Target

    f56656c84c17d1bf6a572bb009c3b6dc74c2854ed8403ef7bb54df2294526c3b.ps1

  • Size

    454KB

  • Sample

    250128-n86yss1lek

  • MD5

    03554089f66f02bf6a5f6f6bb8ed31b1

  • SHA1

    9db4ffb74ec4242f9774163406f22596790ef80d

  • SHA256

    f56656c84c17d1bf6a572bb009c3b6dc74c2854ed8403ef7bb54df2294526c3b

  • SHA512

    857a5acf825d918c5b27a4d8836890cf843d9a1efd1eeb197b83d7dd42b609086c07ca080663e02baebcb8269b8cb604fd8449ce0b8868b23924b7870e3af50a

  • SSDEEP

    1536:K66K5QQcOIH6/cThluPFuyEFBDHIuH7FWRGPP3jU86lsWST+HxYfn8qgy5J+LLgi:Kk7

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

00000001

C2

81.10.39.58:7077

Mutex

AsyncMutex_alosh

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      f56656c84c17d1bf6a572bb009c3b6dc74c2854ed8403ef7bb54df2294526c3b.ps1

    • Size

      454KB

    • MD5

      03554089f66f02bf6a5f6f6bb8ed31b1

    • SHA1

      9db4ffb74ec4242f9774163406f22596790ef80d

    • SHA256

      f56656c84c17d1bf6a572bb009c3b6dc74c2854ed8403ef7bb54df2294526c3b

    • SHA512

      857a5acf825d918c5b27a4d8836890cf843d9a1efd1eeb197b83d7dd42b609086c07ca080663e02baebcb8269b8cb604fd8449ce0b8868b23924b7870e3af50a

    • SSDEEP

      1536:K66K5QQcOIH6/cThluPFuyEFBDHIuH7FWRGPP3jU86lsWST+HxYfn8qgy5J+LLgi:Kk7

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks