General

  • Target

    f0d3cee54bda20b709483c28f133cb5fd9dd313eb4f936186e8eae1c9bb31aa3

  • Size

    25KB

  • Sample

    250329-yc45fawkv7

  • MD5

    bdf04dd451f7cb06c2baadab9712a543

  • SHA1

    40ca5061d63d7744a76c3b1fe2aefcd42b2a8b09

  • SHA256

    f0d3cee54bda20b709483c28f133cb5fd9dd313eb4f936186e8eae1c9bb31aa3

  • SHA512

    1219dd64d41fd24934292675cef2eaf243aa94b05abde211dd64015008ef7d52b0000b1861ee5fa6d88d47bd9d09113b3c972c24622576de3ba2ff2178ed18f5

  • SSDEEP

    768:RGTHbM1cT355Z9wk3ZQ3iO8kcnAypFvlv1a:R2Q1UzZ9wkwin/PptlNa

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:1604

127.0.0.1:1600

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    Valorant Spoofer.exe

  • install_folder

    %Temp%

aes.plain

Targets

    • Target

      Valorant Spoofer 2025 (by BBaox/Valorant Spoofer (by BBaox).exe

    • Size

      47KB

    • MD5

      fd64259b217827ebbe114699e9194ba7

    • SHA1

      3b09e655d4d557ee1fca294613867e9f886dcf7a

    • SHA256

      68fb8f06592b84297fc6adf794044e693bc8ca655502d7c661a5a00128dd37b4

    • SHA512

      a1e35e0edf30da7ae08cfa853cee5aa6b3b53f25c8f06106a93d305115dad1ba12a481e77210a1b3964533d06a7ad346fdd798d91cb4d3a3c19618cddb64c156

    • SSDEEP

      768:Du+K1TQQEX1WUVt1Pmo2qj6tHo0LxT5FWfD7hh0bVXW4yBQaTq+GcDZz1+:Du+K1TQfb2NLxTGfDMbVXjymaWWdz1+

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks