General

  • Target

    449149eabd216c3b638afae9af82fef24b69ede7f6cd9060ed8d85c4f5c97d98

  • Size

    1.9MB

  • Sample

    240730-vc9hdatbmd

  • MD5

    4e875a3ff28c0ef04fac6d93452183f9

  • SHA1

    752ba98fa8471cc6c269bf9263a0335ab1c570d4

  • SHA256

    449149eabd216c3b638afae9af82fef24b69ede7f6cd9060ed8d85c4f5c97d98

  • SHA512

    ae90d5a955260ab2b0b2dd80a3015ffc36a9756ccb5793a5887ceadc2b1fd289cde84131414c2afd37c16b1e315bc0bdee80c1d80c502e8e94c031f8f5c09d0c

  • SSDEEP

    49152:qViscIkQonWfm+uHgSa5sfjFkbSxahKG4VhtPLaRc:qZNm+uHgSa5sfjFkexahvN

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

2-ICONICOS-DIAM

C2

proyectodos307.casacam.net:8011

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      449149eabd216c3b638afae9af82fef24b69ede7f6cd9060ed8d85c4f5c97d98

    • Size

      1.9MB

    • MD5

      4e875a3ff28c0ef04fac6d93452183f9

    • SHA1

      752ba98fa8471cc6c269bf9263a0335ab1c570d4

    • SHA256

      449149eabd216c3b638afae9af82fef24b69ede7f6cd9060ed8d85c4f5c97d98

    • SHA512

      ae90d5a955260ab2b0b2dd80a3015ffc36a9756ccb5793a5887ceadc2b1fd289cde84131414c2afd37c16b1e315bc0bdee80c1d80c502e8e94c031f8f5c09d0c

    • SSDEEP

      49152:qViscIkQonWfm+uHgSa5sfjFkbSxahKG4VhtPLaRc:qZNm+uHgSa5sfjFkexahvN

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks