General

  • Target

    3600-143-0x0000000003290000-0x00000000032A8000-memory.dmp

  • Size

    96KB

  • Sample

    250226-1d62jatwfz

  • MD5

    f9ed3fa9342124460f2db4a9d24436b5

  • SHA1

    308ede6b2537dc691e054d35c1834c00d18e2db2

  • SHA256

    302f376e71961e4841855750e14bbd35e14b5ea8fda98dffe33194716d6d6594

  • SHA512

    d5ae1802c552f5c0fb79efdde5991a41aecb063b957a6deb9991ded6f79aa00cf654294a837b1545cdb85616941b1330f5f4c8ef9bb7bbf3c7bdc50ccf0c057f

  • SSDEEP

    1536:aUZGcx5NVCMoPMVWe9VdQuDI6H1bf/kXOQzcZLVclN:aU8cx5zHoPMVWe9VdQsH1bfOOQQBY

Malware Config

Extracted

Family

asyncrat

Version

Esco Private rat

Botnet

Default

C2

196.251.88.53:4449

Mutex

voodynqjploelta

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      3600-143-0x0000000003290000-0x00000000032A8000-memory.dmp

    • Size

      96KB

    • MD5

      f9ed3fa9342124460f2db4a9d24436b5

    • SHA1

      308ede6b2537dc691e054d35c1834c00d18e2db2

    • SHA256

      302f376e71961e4841855750e14bbd35e14b5ea8fda98dffe33194716d6d6594

    • SHA512

      d5ae1802c552f5c0fb79efdde5991a41aecb063b957a6deb9991ded6f79aa00cf654294a837b1545cdb85616941b1330f5f4c8ef9bb7bbf3c7bdc50ccf0c057f

    • SSDEEP

      1536:aUZGcx5NVCMoPMVWe9VdQuDI6H1bf/kXOQzcZLVclN:aU8cx5zHoPMVWe9VdQsH1bfOOQQBY

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks