General
- Target Fsoc1etyV2.zip
- Size 31KB
- Sample260622-talsvsdz9n
- SHA256 01e33e4cb89dca59e8ec793707cf1a7746c20cf2043ce7693147b6be0bde373b
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.8
Mutex
-
PY2TjDftj6BV
Attributes
-
delay
500
-
install
true
-
install_file
msmpeng.exe
-
install_folder
%AppData%
-
local_host
127.0.0.1
aes.plain
Targets
-
- Target Fsoc1etyV2/FsBackup.py
- Size 9KB
- SHA256 ec756d779cea76ad14d453e1488e0547b556063494f9ad4e3a43a578ed88c200
Score3/10 -
- Target Fsoc1etyV2/FsocUpdater.exe
- Size 48KB
- SHA256 071b3af5d91560900654b10b60ef5b2aae543814ed4f9df8962757799718de37
Score10/10-
Async RAT payload
-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
- Target Fsoc1etyV2/RunFsociety.bat
- Size 613B
- SHA256 2e6f8c0e8563a17fad53ab9a88e2b638ccc84d1f7f3691ddf6228ea178f7f8d2
Score10/10-
Async RAT payload
-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.