asyncrat | c5c0dbc8c442c2a08e860f1924e43e29453caf3396ce503632bfaa3458a2eb11

General

Target
thing3.zip
Size 49KB
Sample260626-x4pndset4v
SHA256 c5c0dbc8c442c2a08e860f1924e43e29453caf3396ce503632bfaa3458a2eb11
MD5 5657152f04489a05ce6b157b25122ebe
SHA1 12f260ada47800cd92b4056f8c50a82ed644f21d
SHA512 3fbc28f2166cf8aa5efb660078659e58b0f9a3ba180663ffaa393409ef62e6ba48fc4cd53b2ae19f7796e892f458ec6ae3d9d4760e8e662091a17154f494d3a6
SSDEEP 768:FWVnyIpfg4WD8hcap+jse21gtUrtt5VaR6WyzJdn7FoFZ0+6DPTDb1M7EEN:Mnpfgtj01gt6tt/7WGNo30PLKwEN
TLSH
T1B233029E8682D7A9EA74945D83BEAB108093E94135BBD6C5DD4CC71EF11980B413F81F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

ymuoQsGwwSru

Attributes

delay
3
install
true
install_file
Mods.exe
install_folder
%AppData%
local_host
127.0.0.1
private_ip
192.168.0.15

aes.plain

Targets

- Target
  thing3.zip
- Size 49KB
- SHA256 c5c0dbc8c442c2a08e860f1924e43e29453caf3396ce503632bfaa3458a2eb11
- MD5 5657152f04489a05ce6b157b25122ebe
- SHA1 12f260ada47800cd92b4056f8c50a82ed644f21d
- SHA512 3fbc28f2166cf8aa5efb660078659e58b0f9a3ba180663ffaa393409ef62e6ba48fc4cd53b2ae19f7796e892f458ec6ae3d9d4760e8e662091a17154f494d3a6
- SSDEEP 768:FWVnyIpfg4WD8hcap+jse21gtUrtt5VaR6WyzJdn7FoFZ0+6DPTDb1M7EEN:Mnpfgtj01gt6tt/7WGNo30PLKwEN
- TLSH
  T1B233029E8682D7A9EA74945D83BEAB108093E94135BBD6C5DD4CC71EF11980B413F81F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  decryptor.bat
- Size 1KB
- SHA256 b3fdc07731e8df4e6ec21df0ca52e3664d168fb0f520698ccc7e90d827ce322f
- MD5 80c140e78997f097c0003e645ea3bd3b
- SHA1 fcf57d850aaac3dfcd500978deb77755281b5895
- SHA512 28e4721dc51346b43e3c114c5a4c4a2c0ef31f298ec2d34cd60e667c89db8f0fcd283b3c568addd6bbe032f9267b00f9bb9f77bcdfc35d65012243cadd5ee1b1
- TLSH
  T1733162143C4F608E05CBC8F36E64E4A66C0F90AF52001E28355C5F483F55551A3FE9F4
- MD5 SHA1 SHA512 TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Executes dropped EXE
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral2
- Target
  msi.exe.enc
- Size 65KB
- SHA256 f0280d2ec2aff8e8408235a71286b2e39427d6cbf3e56050b4898e4d0cda4184
- MD5 05e1719cc2542aab11f96bb67d60776d
- SHA1 cae74cf62f97fbf27aea6a058db65214bb6e1b11
- SHA512 52976f9f4ad5c3bdf834d7f0fa3c4bb7b4861c8ed92a24a21f73004e7eb688774a585ae25e2c6b221edd562441f18f0ff46a0e66693f80638b22da18ea32a607
- SSDEEP 1536:4VGGmiLb4zWChatc26ZclXXZhV6H2T7jC/SV7Cst:4V8CbWJ26ZoHh6H2T7jjust
- TLSH
  T126630DF2F2B86E4285644FC4FEACB5DB448CCE42CD9D8D9D94A49805B1BAF5E406C0CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3