General

  • Target

    6bb1378a0801ff75e9fb86c34539d6b05255a17297810b2e7eccd155e5063c5d

  • Size

    2.4MB

  • Sample

    241009-vx5pxsthnd

  • MD5

    3b7e2d0856ad8df79dbf20ad837a6183

  • SHA1

    4f9b0a8c2c1e9a288d177cea3a0d81873dd20f02

  • SHA256

    6bb1378a0801ff75e9fb86c34539d6b05255a17297810b2e7eccd155e5063c5d

  • SHA512

    9ea0b6182b8ae2902209de24126e60a51378a5ba4ecaf4480fe63dffcb652d1f2f22b31b0576c02a25f38a142d63985856a8506aa140ac5ddb6336e3a4358e08

  • SSDEEP

    49152:cjOR2ikJR8rdwp5hLhMioVf3I5KvfgzSadksa3ZWnisrT:cjOR678O5hLhzoVf7oZdM8niST

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

C2

vulcansy.duckdns.org:1415

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      03201-LEER COPIA DE LA NITIFICACION ENVIADA/02 LEER COPIA NOTIFICACION.exe

    • Size

      966KB

    • MD5

      e634616d3b445fc1cd55ee79cf5326ea

    • SHA1

      ca27a368d87bc776884322ca996f3b24e20645f4

    • SHA256

      1fcd04fe1a3d519c7d585216b414cd947d16997d77d81a2892821f588c630937

    • SHA512

      7d491c0a97ce60e22238a1a3530f45fbb3c82377b400d7986db09eccad05c9c22fb5daa2b4781882f870ab088326e5f6156613124caa67b54601cbad8f66aa90

    • SSDEEP

      24576:we3xAibB85Z1HrWtB8z1L1OTJu5zzz3zzzozzz3zzzSZ:HxAibBEZ1LWtBzQrZ

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Suspicious use of SetThreadContext

    • Target

      03201-LEER COPIA DE LA NITIFICACION ENVIADA/libvlc.dll

    • Size

      186KB

    • MD5

      4b262612db64f26ea1168ca569811110

    • SHA1

      8e59964d1302a3109513cd4fd22c1f313e79654c

    • SHA256

      a9340c99206f3388153d85df4ca94d33b28c60879406cc10ff1fd10eae16523f

    • SHA512

      9902e64eb1e5ed4c67f4b7e523b41bde4535148c6be20db5f386a1da74533ca575383f1b3154f5985e379df9e1e164b6bda25a66504edcfaa57d40b04fc658c7

    • SSDEEP

      3072:f3jr3xal+e5Wz5+xCwcNohCMYMUyNUjqsbJLyLM5xjxN:f3jFe5WYYwRj4yNMqSLyLS

    Score
    1/10
    • Target

      03201-LEER COPIA DE LA NITIFICACION ENVIADA/libvlccore.dll

    • Size

      2.7MB

    • MD5

      c776546c8ad8ed9fd6135fb4ca6075e4

    • SHA1

      3fce55713cf2da830bea31f747b63850f71157c5

    • SHA256

      7983c071618a3c042bf3079fcfa56aff9867a3d38b2e9f85c1a152547074fc83

    • SHA512

      65084e55c96116f085f9c036fca92c27640d652fccc6b23ad09c5ae40b407a5c1e1af075c31a99d22ab95577c2ba67bf62cf7eb906de92711de8d4d0ad15d3c7

    • SSDEEP

      49152:lA9qEelmNGJRcsADizpXtBOy2BAUZLY6sEZGaXBuQQ9eyI:sq8fW2BAUZL3l

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks