General

  • Target

    Comparendo.tar

  • Size

    181KB

  • Sample

    240723-qrbgnssdpj

  • MD5

    b37868e4da715fd5510d451e5b97f4b8

  • SHA1

    2e9c49e096ba059fa7f7f4ac35d8856a560c1e68

  • SHA256

    81e2cb9d51589bbd0d1e7a99f552854fcb81d852f225943d155552bccc4b8e0d

  • SHA512

    9e2ed9a631a1aaf4f32df31a1469bd5e413ac34494d94f0f971b7524af93787b3308116e0de8e6bb0cc7f2695ae2d77c3e1a75537784186531259f237b795886

  • SSDEEP

    3072:j71TPGcF3gBfwb+HpJ6RfdK7JL47fPiPc11e7GnK/Z879khLVSWsc7IaVeiGSig7:j7J+CgwaJYRs7+Cu07SKR8YLVS3aV7ie

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

dxpam.duckdns.org:5999

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Comparendo.tar

    • Size

      181KB

    • MD5

      b37868e4da715fd5510d451e5b97f4b8

    • SHA1

      2e9c49e096ba059fa7f7f4ac35d8856a560c1e68

    • SHA256

      81e2cb9d51589bbd0d1e7a99f552854fcb81d852f225943d155552bccc4b8e0d

    • SHA512

      9e2ed9a631a1aaf4f32df31a1469bd5e413ac34494d94f0f971b7524af93787b3308116e0de8e6bb0cc7f2695ae2d77c3e1a75537784186531259f237b795886

    • SSDEEP

      3072:j71TPGcF3gBfwb+HpJ6RfdK7JL47fPiPc11e7GnK/Z879khLVSWsc7IaVeiGSig7:j7J+CgwaJYRs7+Cu07SKR8YLVS3aV7ie

    Score
    3/10
    • Target

      RAD001A65247825014705151869862547982105862060662525875202154784782553 Simit Dirección Nacional consulta tu estado de comparendos.exe

    • Size

      333KB

    • MD5

      2edc069ff3ad923a690b87b479a5730b

    • SHA1

      6a2b61caaee1a01e07600733817b0fd246df0aef

    • SHA256

      11eb08d4313711c1753029776d19d11eaabba4af381b456ccc405cd1d5784752

    • SHA512

      09d0e3eac70c16085e95afaa12e72a34e084b33b3a3d77fecf075213aaaa8000b80bc210627b9e538b96ddc1f289bc0c3039025d7638600d41c60833ce72bea6

    • SSDEEP

      6144:wYm5SAxmMS6Ywg6KaCMlAm3LGnLiXKZJd+p3ohpNEx:wYaSSFjg6KaFAFXyoJ

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

MITRE ATT&CK Enterprise v15

Tasks