Overview

overview

10

Static

static

3

Proceso_Ci...3..exe

windows7-x64

10

Proceso_Ci...3..exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Proceso_Civil_Juridico_N°_41731913.tar

  • Size

    820KB

  • Sample

    240716-rwtpgszerb

  • MD5

    c87245e9194c8454ba37f1106a789e87

  • SHA1

    28fdb1feb557d74dab45eb2ccae34155b5fa4f4d

  • SHA256

    5f32f73950f142eb453b956e2424742fbd93e399333561ce57a4c691f16df8d2

  • SHA512

    e1db26e5507ae55fb875ff7e6968fbd8300d1c0ef264a2b7d1df453177ff27008a1a206517a65d45c58dce1bf3a5fbf0cc945d02522ae3c089ee2793ecd80535

  • SSDEEP

    24576:s3Pxd9Db3IHTJYKlP3J9kGt6X5xOBEJIpci2u6HSc:SfDLkNtHk6c5AqJxi2u6HSc

Score
10/10
asyncratvictoriosospersistencerat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

VICTORIOSOS

C2

paisesbajos12.casacam.net:8009

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Proceso_Civil_Juridico_N°_41731913..exe

    • Size

      1.7MB

    • MD5

      9f2f4eacae8e4bfb705679dcc7a6be87

    • SHA1

      0884ef61cfbfb8e794fbfa9d3465603e3b7bbe87

    • SHA256

      304db7f796f881d8013499644940efd37ae9b1d22769784bd338c123c725225c

    • SHA512

      537bb7e42a4fdf255941a315348a935f5b80c6555c1484682ff615569670070d240fce80a9c28157c9008268f2eb4c0545b5b5fd371258c293a7326d9aefcc7b

    • SSDEEP

      49152:JDUNJNsGLoD5gs673cgMMbwF46U8jM+9XB6JQI1yo:JD6J4R+OM+K1yo

    Score
    10/10
    asyncratvictoriosospersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks