General

  • Target
    c4.exe
  • Size 48KB
  • Sample260724-tn8jsasvas
  • SHA256 a36a1de4706be7436988ba9d07e7cf16ef29863f9a6960ad24dd817ccba1dc4d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • asyncrat

Version
  • 0.5.8

Botnet
  • Default

C2
  • tottrot.org/:6606

  • tottrot.org/:80

  • tottrot.org/:8080

  • tottrot.org/:443

  • tottrot.org/:8443

  • tottrot.org/:22

  • tottrot.org/:23

  • apklampung4d.buzz/:6606

  • apklampung4d.buzz/:80

  • apklampung4d.buzz/:8080

  • apklampung4d.buzz/:443

  • apklampung4d.buzz/:8443

  • apklampung4d.buzz/:22

  • apklampung4d.buzz/:23

  • aaalandje.nl/:6606

  • aaalandje.nl/:80

  • aaalandje.nl/:8080

  • aaalandje.nl/:443

  • aaalandje.nl/:8443

  • aaalandje.nl/:22

Mutex
  • AMAEULL6JnCa

Attributes
  • delay

    3

  • install

    true

  • install_file

    GoogleUpdate.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      c4.exe
    • Size 48KB
    • SHA256 a36a1de4706be7436988ba9d07e7cf16ef29863f9a6960ad24dd817ccba1dc4d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Async RAT payload

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks