General

  • Target

    8f1c12f90ac2afb6baf5d40bf4122b62c3867d421eda1cd785443c51c7f8ada2.ps1

  • Size

    170KB

  • Sample

    250128-n9q9qsxrbs

  • MD5

    73afa5b1daf85fdb1b64b0bfc8dd948f

  • SHA1

    3c83cd3261d1fee840b6da054a84e4ab40df52f9

  • SHA256

    8f1c12f90ac2afb6baf5d40bf4122b62c3867d421eda1cd785443c51c7f8ada2

  • SHA512

    6e1a2fbec9aa4feaa2d52cdd5d253b08c7a09eaab1df8bf681be32ec2ac251937cc092200bfe2b1e101602ab2b092e5220862e68f97b9d40f19bf3dc9328e889

  • SSDEEP

    3072:MQoHePgWgLgPG0WYRYwNWprNONXT+jGt6yjcL8hDcseHcTt6tPgzGJVvfP:MRHePgWgLYnRYwNWprNONX6Ct6R

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

00000001

C2

81.10.39.58:7077

Mutex

AsyncMutex_alosh

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      8f1c12f90ac2afb6baf5d40bf4122b62c3867d421eda1cd785443c51c7f8ada2.ps1

    • Size

      170KB

    • MD5

      73afa5b1daf85fdb1b64b0bfc8dd948f

    • SHA1

      3c83cd3261d1fee840b6da054a84e4ab40df52f9

    • SHA256

      8f1c12f90ac2afb6baf5d40bf4122b62c3867d421eda1cd785443c51c7f8ada2

    • SHA512

      6e1a2fbec9aa4feaa2d52cdd5d253b08c7a09eaab1df8bf681be32ec2ac251937cc092200bfe2b1e101602ab2b092e5220862e68f97b9d40f19bf3dc9328e889

    • SSDEEP

      3072:MQoHePgWgLgPG0WYRYwNWprNONXT+jGt6yjcL8hDcseHcTt6tPgzGJVvfP:MRHePgWgLYnRYwNWprNONX6Ct6R

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks