General

  • Target

    7b67a52898fbc14b355096ad182174a2ee3ccff8f80ba332cffca0b9a0e0c0c3.ps1

  • Size

    453KB

  • Sample

    250128-pghmkayjg1

  • MD5

    6ff3b45877c4ef36ba37eddf27ca6c17

  • SHA1

    9533b56f3a3f0eace1ee30f0f7ad6e237557e2cb

  • SHA256

    7b67a52898fbc14b355096ad182174a2ee3ccff8f80ba332cffca0b9a0e0c0c3

  • SHA512

    b0a85163a9dba9b316eeeb53823c09db5beb1487ee91d5aaada88ce719b956c91e1f7cc62b454f2761bf16f9bd3626fc6ce0eddc177740808666a537dfc6e6e5

  • SSDEEP

    1536:zGdW/z20+u4dXNR8WrlDnzDT2ybMVwO8zNdEunygsmj+oN8NGHbEh4WMx+m6y3xH:z0E+NPVFL2bUCUrNlKomLJVlCsspa14

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

00000001

C2

81.10.39.58:7077

Mutex

AsyncMutex_alosh

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      7b67a52898fbc14b355096ad182174a2ee3ccff8f80ba332cffca0b9a0e0c0c3.ps1

    • Size

      453KB

    • MD5

      6ff3b45877c4ef36ba37eddf27ca6c17

    • SHA1

      9533b56f3a3f0eace1ee30f0f7ad6e237557e2cb

    • SHA256

      7b67a52898fbc14b355096ad182174a2ee3ccff8f80ba332cffca0b9a0e0c0c3

    • SHA512

      b0a85163a9dba9b316eeeb53823c09db5beb1487ee91d5aaada88ce719b956c91e1f7cc62b454f2761bf16f9bd3626fc6ce0eddc177740808666a537dfc6e6e5

    • SSDEEP

      1536:zGdW/z20+u4dXNR8WrlDnzDT2ybMVwO8zNdEunygsmj+oN8NGHbEh4WMx+m6y3xH:z0E+NPVFL2bUCUrNlKomLJVlCsspa14

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks