Overview

overview

10

Static

static

10

GunsLOL/GunsLOL.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    GunsLOL.rar

  • Size

    101KB

  • Sample

    250520-ysgn3sbq51

  • MD5

    57bb4d04291fe6b2e25531f13b852109

  • SHA1

    5f39deb2f0615ec9f385b9da86ee6867b794aeb9

  • SHA256

    e0069b821a348f3b4551ecca8c52550a73deb8ab2d155461d173fdad8adb5bc4

  • SHA512

    133306067b2918cb477a199ac570f4af0ba89e3a545df068af93a97c3e66820f2a6ed51c573465277107b36ba8ad3b84fb95cda2f01191dc79106198c5de411e

  • SSDEEP

    3072:qF+gdU+LtiBMoRWoSrKypUI+jzpuVH6UJK:qF+gU+xiPWz+oIiH5s

Score
10/10
asyncratmotion babydiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Motion Baby

C2

0.0.0.0:4449

0.0.0.0:12369

5.tcp.eu.ngrok.io:4449

5.tcp.eu.ngrok.io:12369
Mutex

WindowsMutex

Attributes
  • delay

    5

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      GunsLOL/GunsLOL.exe

    • Size

      327KB

    • MD5

      132068ce2014b0c633cbd7daf72bf61a

    • SHA1

      40404e98a46e8fc3597c1ba66c50e054c4edb631

    • SHA256

      1435240d758c85c726e95bc002a57169dcc091e7edc88095260405ad3a1cdae4

    • SHA512

      f7b06fd348be626f4f84ba6276093a3f05d95e3e27054fe1fc0647ae6c486b0f72c8b8d39a3ee79208aa84cded8448379ed7dfa2a089c4aa5f54cdc2c93aa8c9

    • SSDEEP

      6144:Th0LbRQkB4tkub594IEDyS7d2Vn1hfaNto:3kQEDyE4Ws

    Score
    10/10
    asyncratmotion babydiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks