General

  • Target

    8c162d248940ee7851490c80390d0a6bc614cad19116b7b9c1106bf82205edc2.ps1

  • Size

    453KB

  • Sample

    250128-n9q9qs1lfm

  • MD5

    e00d8713d99df32b405782e54835cc0f

  • SHA1

    eb9f4a732395aa9a877bd12c1137b42fa7ee8f04

  • SHA256

    8c162d248940ee7851490c80390d0a6bc614cad19116b7b9c1106bf82205edc2

  • SHA512

    72c7c9bb0eae9678238c3ae50e6ff36c204a46593d86aac27a339033ecd7040d0c5aac5d4788474f3d848285be231cf120723a11ca9df12c42bc6cbeb99ce757

  • SSDEEP

    1536:zGAdW/z20+u4dXNR8WrlDnhDT2ybMVwO8zNdEunygsmj+oN8NGHbEh4WMx+m6y3z:zZE+NPVFL2bUCUrNlKomLJVlCsspTd

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

00000001

C2

81.10.39.58:7077

Mutex

AsyncMutex_alosh

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      8c162d248940ee7851490c80390d0a6bc614cad19116b7b9c1106bf82205edc2.ps1

    • Size

      453KB

    • MD5

      e00d8713d99df32b405782e54835cc0f

    • SHA1

      eb9f4a732395aa9a877bd12c1137b42fa7ee8f04

    • SHA256

      8c162d248940ee7851490c80390d0a6bc614cad19116b7b9c1106bf82205edc2

    • SHA512

      72c7c9bb0eae9678238c3ae50e6ff36c204a46593d86aac27a339033ecd7040d0c5aac5d4788474f3d848285be231cf120723a11ca9df12c42bc6cbeb99ce757

    • SSDEEP

      1536:zGAdW/z20+u4dXNR8WrlDnhDT2ybMVwO8zNdEunygsmj+oN8NGHbEh4WMx+m6y3z:zZE+NPVFL2bUCUrNlKomLJVlCsspTd

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks