General

  • Target

    75938ac69c673d67db37935a2c882a56d21f8085a326a61033a41c61a969353c.ps1

  • Size

    453KB

  • Sample

    250128-qg9xgssncq

  • MD5

    dfc24069261dc85eda81abcb07e55c69

  • SHA1

    f630b39909c81d172d434bd2b59ec3a2fd855a97

  • SHA256

    75938ac69c673d67db37935a2c882a56d21f8085a326a61033a41c61a969353c

  • SHA512

    705cffd220ef303b45cfff7687946e52098166c0c7bf4f6973947786372a789df85233ebcd67b302a9b255fc08262e367356b057024190b23ef13d1a99e4e3eb

  • SSDEEP

    6144:4ABE+NPVFL2bUCUrNlKomLJVlCssptqzo:JE+NPVFL2bUCUrNlKomLJVlCzso

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

00000001

C2

81.10.39.58:7077

Mutex

AsyncMutex_alosh

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      75938ac69c673d67db37935a2c882a56d21f8085a326a61033a41c61a969353c.ps1

    • Size

      453KB

    • MD5

      dfc24069261dc85eda81abcb07e55c69

    • SHA1

      f630b39909c81d172d434bd2b59ec3a2fd855a97

    • SHA256

      75938ac69c673d67db37935a2c882a56d21f8085a326a61033a41c61a969353c

    • SHA512

      705cffd220ef303b45cfff7687946e52098166c0c7bf4f6973947786372a789df85233ebcd67b302a9b255fc08262e367356b057024190b23ef13d1a99e4e3eb

    • SSDEEP

      6144:4ABE+NPVFL2bUCUrNlKomLJVlCssptqzo:JE+NPVFL2bUCUrNlKomLJVlCzso

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks