General

  • Target

    N5WVQ_file.exe

  • Size

    13.4MB

  • Sample

    250228-yw3qqaxkw2

  • MD5

    bdfd72d13ed24048e040fa1ec269ba66

  • SHA1

    92399e6601eafe6ea7ab6016fd84d457f92022d9

  • SHA256

    460e9bf5267cbb9e7eac888d76c56cfe9fc254c31df22a42ab2c9fddcf682915

  • SHA512

    ee6377901f6f5d6d6fe43961e0b34ec215767676b1f51a5f98463abef064ccaeea19fe13ee1b1854c331f164610ec92ee411ef59994b5e249135e0b6f44fb6dd

  • SSDEEP

    196608:sr7MtO4mHJUtcY0RZStCbUOptduI0II2xPs2bgWSr6afW05xU/ZppNVcRFNoh9VD:skOHyP8b6HIZi2vSr6a/5xUhrkQrIFS

Malware Config

Extracted

Family

asyncrat

Version

Esco Private rat

Botnet

Default

C2

195.211.191.181:4449

Mutex

yeqnpswtkul

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      N5WVQ_file.exe

    • Size

      13.4MB

    • MD5

      bdfd72d13ed24048e040fa1ec269ba66

    • SHA1

      92399e6601eafe6ea7ab6016fd84d457f92022d9

    • SHA256

      460e9bf5267cbb9e7eac888d76c56cfe9fc254c31df22a42ab2c9fddcf682915

    • SHA512

      ee6377901f6f5d6d6fe43961e0b34ec215767676b1f51a5f98463abef064ccaeea19fe13ee1b1854c331f164610ec92ee411ef59994b5e249135e0b6f44fb6dd

    • SSDEEP

      196608:sr7MtO4mHJUtcY0RZStCbUOptduI0II2xPs2bgWSr6afW05xU/ZppNVcRFNoh9VD:skOHyP8b6HIZi2vSr6a/5xUhrkQrIFS

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • VenomRAT

      Detects VenomRAT.

    • Venomrat family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks