General

  • Target

    9e7e889cd315a48ba053cd2eaa2b94a13b21c99ef6080dc407de5b229fd65f39

  • Size

    48KB

  • Sample

    250330-ymr8maxrx3

  • MD5

    8f6d46648eddaa43538e484425a43f84

  • SHA1

    33b35c1cf919cff27485454ad3e054552e1f1456

  • SHA256

    9e7e889cd315a48ba053cd2eaa2b94a13b21c99ef6080dc407de5b229fd65f39

  • SHA512

    b60751a6d563d37543ca7a9edec554752af13778d2d11f74eec6a5d37e65cd2ef0fec49f66bcb2ae58fd0aa0cea7b183bb7f411620a27e30601c475b95bfb6a5

  • SSDEEP

    768:2nAmcILiCu2Y+bipYdfyXxisb8YbLgwKELcdvEgK/JyWVc6KN:2nAt24pYxyXXzb0YGnkJyWVclN

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

Mutex

DcRatMutex_qwqdanchun

Attributes
  • c2_url_file

    https://Pastebin.com/raw/fevFJe98

  • delay

    1

  • install

    false

  • install_file

    hwidspoof

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      9e7e889cd315a48ba053cd2eaa2b94a13b21c99ef6080dc407de5b229fd65f39

    • Size

      48KB

    • MD5

      8f6d46648eddaa43538e484425a43f84

    • SHA1

      33b35c1cf919cff27485454ad3e054552e1f1456

    • SHA256

      9e7e889cd315a48ba053cd2eaa2b94a13b21c99ef6080dc407de5b229fd65f39

    • SHA512

      b60751a6d563d37543ca7a9edec554752af13778d2d11f74eec6a5d37e65cd2ef0fec49f66bcb2ae58fd0aa0cea7b183bb7f411620a27e30601c475b95bfb6a5

    • SSDEEP

      768:2nAmcILiCu2Y+bipYdfyXxisb8YbLgwKELcdvEgK/JyWVc6KN:2nAt24pYxyXXzb0YGnkJyWVclN

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks