General

  • Target

    OFICIO REMISORIO N° 225374198.UUE

  • Size

    958KB

  • Sample

    241010-wjl64ayejf

  • MD5

    8ea3a2e7c8b5576fbe35faae4b825e40

  • SHA1

    f570beefbac268457f9a4fca248c612fb208d255

  • SHA256

    d757220303ba2375cddfe686e9ff44bb758a19e2faf63296fadf9911528207e2

  • SHA512

    b45662493500a43d19aa27cfc4264cbc93e8df2b92323de0348c3751d6561b4ef244d9521d506e08e3c61d89c7481b490c909409b306ccdc49c92c0bbd62b796

  • SSDEEP

    12288:0lRAH//JpYDDZsF7jkpebOIMgZVwHTOrnC7niSWJJLzMt6OIEZIMpxnPfB/VPPYL:0UHZpO6JjceZV6CQi9DMtdIE6gPfjnL4

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

octubre 9

C2

dcmen09.duckdns.org:6000

Mutex

firewalljegjgghfyfyfyksklddhcmsjgkeedhkio

Attributes
  • delay

    10

  • install

    false

  • install_file

    defender

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      OFICIO REMISORIO N° 225374198.UUE

    • Size

      958KB

    • MD5

      8ea3a2e7c8b5576fbe35faae4b825e40

    • SHA1

      f570beefbac268457f9a4fca248c612fb208d255

    • SHA256

      d757220303ba2375cddfe686e9ff44bb758a19e2faf63296fadf9911528207e2

    • SHA512

      b45662493500a43d19aa27cfc4264cbc93e8df2b92323de0348c3751d6561b4ef244d9521d506e08e3c61d89c7481b490c909409b306ccdc49c92c0bbd62b796

    • SSDEEP

      12288:0lRAH//JpYDDZsF7jkpebOIMgZVwHTOrnC7niSWJJLzMt6OIEZIMpxnPfB/VPPYL:0UHZpO6JjceZV6CQi9DMtdIE6gPfjnL4

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks