2021-10-20 AsyncRAT IOCs

THREAT IDENTIFICATION:  ASYNCRAT

SUBJECTS OBSERVED
Payment Copy Document

SENDERS OBSERVED
training@qeati.com

EMAIL BODY
Hello,

Please find attached payment copy.

Looking foward to hearing from you
Thank you & Best Regards

MALDOC FILE HASHES
Payment Copy.zip
29f8662a6db0ae18cf790f046787d201

ASYNCRAT PAYLOAD FILE HASHES
Payment Copy.exe
917af4200d799a64919795d98418da12

Renamed and copied to AppData\Roaming
zJSwrCsBJ.exe
917af4200d799a64919795d98418da12

ASYNCRAT C2
79.134.225.35:1004

SUPPORTING EVIDENCE
https://tria.ge/211020-v218asacen