General

  • Target

    e17921bea1470cc872b6a1a1ec2b31f82332bfefb57faaf1b782c5bda0d0530d

  • Size

    63KB

  • Sample

    250420-x7yepswkx9

  • MD5

    b084f9671ccc68bff77cd3f15b784498

  • SHA1

    c3ad6ea4d98109d3755b6eb8df7fd9410057662a

  • SHA256

    e17921bea1470cc872b6a1a1ec2b31f82332bfefb57faaf1b782c5bda0d0530d

  • SHA512

    bd4c8ed42dc954381c899a6ad645e44744a4a9571fda0ef59f41e0b1aa78278f1f4d4a1cdf3e46524cc54241d1a150b9e59567be78fc7da2240c854c84c2b33f

  • SSDEEP

    768:kk/9PXn1w787gC8A+XvqazcBRL5JTk1+T4KSBGHmDbD/ph0oXryg6WcOSu13pqKX:xR1gMdSJYUbdh91cZu13pqKmY7

Score
10/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

carolina-candles.gl.at.ply.gg:34316

Attributes
  • delay

    1

  • install

    true

  • install_file

    square.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      e17921bea1470cc872b6a1a1ec2b31f82332bfefb57faaf1b782c5bda0d0530d

    • Size

      63KB

    • MD5

      b084f9671ccc68bff77cd3f15b784498

    • SHA1

      c3ad6ea4d98109d3755b6eb8df7fd9410057662a

    • SHA256

      e17921bea1470cc872b6a1a1ec2b31f82332bfefb57faaf1b782c5bda0d0530d

    • SHA512

      bd4c8ed42dc954381c899a6ad645e44744a4a9571fda0ef59f41e0b1aa78278f1f4d4a1cdf3e46524cc54241d1a150b9e59567be78fc7da2240c854c84c2b33f

    • SSDEEP

      768:kk/9PXn1w787gC8A+XvqazcBRL5JTk1+T4KSBGHmDbD/ph0oXryg6WcOSu13pqKX:xR1gMdSJYUbdh91cZu13pqKmY7

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks