General

  • Target

    fa44603f49250d641e2d89f2ffac8da2d6c28b744220c2014cd4562ad1b8b177.ps1

  • Size

    456KB

  • Sample

    250129-eaa9sszncy

  • MD5

    0be72c691a3579556b65982fa2cfcae7

  • SHA1

    20dcc09771531da63e1d4c1748696982d8e68e34

  • SHA256

    fa44603f49250d641e2d89f2ffac8da2d6c28b744220c2014cd4562ad1b8b177

  • SHA512

    0d01c73c0a5d49a0e1a57cdf656369ef5e334f9b789978d376532ba38f9512b2d62a9e79a46fd515689c06a8b3846ae5c037b8a33ff6c8f4b27ffffad53ca36f

  • SSDEEP

    1536:zMdW/z20+u4dXNR8WrlDnOzewhq2staE/a9ktzj1EV82Wa1vw9eoi1SOiosGTQBi:zwnbNGQ/Jfz0

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

00000001

C2

81.10.39.58:7077

Mutex

AsyncMutex_alosh

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      fa44603f49250d641e2d89f2ffac8da2d6c28b744220c2014cd4562ad1b8b177.ps1

    • Size

      456KB

    • MD5

      0be72c691a3579556b65982fa2cfcae7

    • SHA1

      20dcc09771531da63e1d4c1748696982d8e68e34

    • SHA256

      fa44603f49250d641e2d89f2ffac8da2d6c28b744220c2014cd4562ad1b8b177

    • SHA512

      0d01c73c0a5d49a0e1a57cdf656369ef5e334f9b789978d376532ba38f9512b2d62a9e79a46fd515689c06a8b3846ae5c037b8a33ff6c8f4b27ffffad53ca36f

    • SSDEEP

      1536:zMdW/z20+u4dXNR8WrlDnOzewhq2staE/a9ktzj1EV82Wa1vw9eoi1SOiosGTQBi:zwnbNGQ/Jfz0

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks