General

  • Target

    0fbc9522bea75aaa0af04e252a09206170b17ff4811a930fe2a0c812a48c2382

  • Size

    48KB

  • Sample

    250329-xynh5szxbz

  • MD5

    e48fe350eb0aeb4cedafd2c9ae689c96

  • SHA1

    d0fb07d47835b00d21d258dbcc0e673d1c1ae861

  • SHA256

    0fbc9522bea75aaa0af04e252a09206170b17ff4811a930fe2a0c812a48c2382

  • SHA512

    a9f5b762f7688ea06a72475beeb61b3bbc6d726122e470f6a6370c1c3c4fea4e85d5fc697843eb745ca5f079f0103a2500af9b669c886143d514631165c032b3

  • SSDEEP

    768:OuUjVTwkbBHWU72ZcFmo2qj7bYZC25vPIk9vOfk0bmu1mF8hS+0FO2eefEBDZJS7:OuUjVTwA4M2vZC+ok4fHbm2S8hS+UfyG

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

9GqQYIlq5eZK

Attributes
  • delay

    3

  • install

    true

  • install_file

    CheckerAVT.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/63vbbiAr

aes.plain

Targets

    • Target

      0fbc9522bea75aaa0af04e252a09206170b17ff4811a930fe2a0c812a48c2382

    • Size

      48KB

    • MD5

      e48fe350eb0aeb4cedafd2c9ae689c96

    • SHA1

      d0fb07d47835b00d21d258dbcc0e673d1c1ae861

    • SHA256

      0fbc9522bea75aaa0af04e252a09206170b17ff4811a930fe2a0c812a48c2382

    • SHA512

      a9f5b762f7688ea06a72475beeb61b3bbc6d726122e470f6a6370c1c3c4fea4e85d5fc697843eb745ca5f079f0103a2500af9b669c886143d514631165c032b3

    • SSDEEP

      768:OuUjVTwkbBHWU72ZcFmo2qj7bYZC25vPIk9vOfk0bmu1mF8hS+0FO2eefEBDZJS7:OuUjVTwA4M2vZC+ok4fHbm2S8hS+UfyG

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks