General

  • Target

    2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b.exe

  • Size

    140KB

  • Sample

    240229-f1458seh78

  • MD5

    a4ddde2d6e9370b5cc5572f97eb2071d

  • SHA1

    ee88603b9e64f3af4de73a3a5f6f2676a84dafd8

  • SHA256

    2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b

  • SHA512

    5174a7bbe499db1e0a2ba944d11e6c70c308265962376a0577f1816f9b88afe185b55fa3a649e722ad753c05d4ccd0a26c3d0dc0a9142a57e5ae850d7912b247

  • SSDEEP

    3072:FiGpa7x6bEGuXYEzNfRWtA2zvigEyapFS/b6JQ9LaeMR:FiKa7kbwoEZqji9i/6QnQ

Malware Config

Extracted

Family

asyncrat

Version

| nelsontriana980

Botnet

Asegurar-Casa

C2

subdominiodesub.duckdns.org:1111

Mutex

AsyncMutex_GNhcP0aLwKV1

Attributes
  • delay

    3

  • install

    false

  • install_file

    WD.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b.exe

    • Size

      140KB

    • MD5

      a4ddde2d6e9370b5cc5572f97eb2071d

    • SHA1

      ee88603b9e64f3af4de73a3a5f6f2676a84dafd8

    • SHA256

      2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b

    • SHA512

      5174a7bbe499db1e0a2ba944d11e6c70c308265962376a0577f1816f9b88afe185b55fa3a649e722ad753c05d4ccd0a26c3d0dc0a9142a57e5ae850d7912b247

    • SSDEEP

      3072:FiGpa7x6bEGuXYEzNfRWtA2zvigEyapFS/b6JQ9LaeMR:FiKa7kbwoEZqji9i/6QnQ

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects executables packed with SmartAssembly

    • Detects file containing reversed ASEP Autorun registry keys

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks