Overview

overview

10

Static

static

1

449149eabd...98.exe

windows7-x64

10

449149eabd...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4e875a3ff28c0ef04fac6d93452183f9.bin

  • Size

    924KB

  • Sample

    240802-ce66xstflg

  • MD5

    d925c7d955312899b41b7c728f093553

  • SHA1

    cd6f86238bbd9647958bf505bc774c3a75d044b3

  • SHA256

    4b2ceb45bfcbe6133717057a75cb43d2897e082e31f8c349ee6dd28fd904578a

  • SHA512

    c4f4c29c7af5fe9fe14910404cf793254c096c0657876c72658c23d618715463bf78bae95a231a2a0e47d0b3836a0096796ec78b1978edb9bbae48e1e23004c4

  • SSDEEP

    12288:/Eel95UsQvePUBqu77f+qXkOroZBUvdzPKzf/eoByZ6Qb6fGNwhdj0WlMew9SM+V:/MMPU0uxXkOrmmdzA+huFMew2T8Cjo4

Score
10/10
asyncrat2-iconicos-diamdiscoverypersistencerat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

2-ICONICOS-DIAM

C2

proyectodos307.casacam.net:8011

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      449149eabd216c3b638afae9af82fef24b69ede7f6cd9060ed8d85c4f5c97d98.exe

    • Size

      1.9MB

    • MD5

      4e875a3ff28c0ef04fac6d93452183f9

    • SHA1

      752ba98fa8471cc6c269bf9263a0335ab1c570d4

    • SHA256

      449149eabd216c3b638afae9af82fef24b69ede7f6cd9060ed8d85c4f5c97d98

    • SHA512

      ae90d5a955260ab2b0b2dd80a3015ffc36a9756ccb5793a5887ceadc2b1fd289cde84131414c2afd37c16b1e315bc0bdee80c1d80c502e8e94c031f8f5c09d0c

    • SSDEEP

      49152:qViscIkQonWfm+uHgSa5sfjFkbSxahKG4VhtPLaRc:qZNm+uHgSa5sfjFkexahvN

    Score
    10/10
    asyncrat2-iconicos-diamdiscoverypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks