General

  • Target

    a0c23da83086dd6655b2958031c035d60a3275fc29614746f74312f26941e72b.ps1

  • Size

    454KB

  • Sample

    250128-n9qyzaxra1

  • MD5

    1ca236b257149bafff47795b53f06dba

  • SHA1

    6f0bdf146cd44a2317f64011cbf218eaae740697

  • SHA256

    a0c23da83086dd6655b2958031c035d60a3275fc29614746f74312f26941e72b

  • SHA512

    0899f42019d6bf09f54e13334ac1005a0880ef2b4d071d9216d3705fa51367bb5e33b0da46058df2c6e0ae17415ed61132ed5a4cda48cffaf30fa49f9c30c51f

  • SSDEEP

    1536:zldW/z20+u4dXNR8WrlDn4IuH7FWRGPP3jU86lsWST+HxYfn8qgy5J+LLg7WMJVk:zBadjK

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

00000001

C2

81.10.39.58:7077

Mutex

AsyncMutex_alosh

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      a0c23da83086dd6655b2958031c035d60a3275fc29614746f74312f26941e72b.ps1

    • Size

      454KB

    • MD5

      1ca236b257149bafff47795b53f06dba

    • SHA1

      6f0bdf146cd44a2317f64011cbf218eaae740697

    • SHA256

      a0c23da83086dd6655b2958031c035d60a3275fc29614746f74312f26941e72b

    • SHA512

      0899f42019d6bf09f54e13334ac1005a0880ef2b4d071d9216d3705fa51367bb5e33b0da46058df2c6e0ae17415ed61132ed5a4cda48cffaf30fa49f9c30c51f

    • SSDEEP

      1536:zldW/z20+u4dXNR8WrlDn4IuH7FWRGPP3jU86lsWST+HxYfn8qgy5J+LLg7WMJVk:zBadjK

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks