Overview

overview

10

Static

static

3

DEMANDA JU...al.exe

windows7-x64

10

DEMANDA JU...al.exe

windows10-2004-x64

10

DEMANDA JU...RT.dll

windows7-x64

1

DEMANDA JU...RT.dll

windows10-2004-x64

1

DEMANDA JU...00.dll

windows7-x64

1

DEMANDA JU...00.dll

windows10-2004-x64

1

DEMANDA JU...00.dll

windows7-x64

1

DEMANDA JU...00.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2dd89534869bb9d806c255437154a5ad7e26e67050dbcb73df4e7d2382b9db4

  • Size

    2.7MB

  • Sample

    241018-2ar9mstdmk

  • MD5

    22ea943ccb93ae0531b86f2852550163

  • SHA1

    3c92f63ced59cf3876b0c41da658356b7447a783

  • SHA256

    d2dd89534869bb9d806c255437154a5ad7e26e67050dbcb73df4e7d2382b9db4

  • SHA512

    1ed94b5fb4b2221fedc7212257919439c9ae3af7a9c20606e5b4f0e7315b9809704fe555e847bd8400073f07e62da36aa80667018d0b45ad4c1d9e087c0cda7b

  • SSDEEP

    49152:zNe9miipcWJXe1UAOf0q24Ne4X5kKbETECMTSMdGANCAkZKu+Ey4LBEIGnIP:zjTmWAEcq24NB5M9MTldqgu+EdLOI6IP

Score
10/10
asyncratpowermoneydiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

POWERMONEY

C2

powermaster1.kozow.com:6161

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      DEMANDA JUDICIAL ESPECIAL 13252548/01Aviso juridico especial.exe

    • Size

      58KB

    • MD5

      d31086fca1a6d45927d90963ffd1989b

    • SHA1

      bce4e7984ca862c678ee9395e94c10d60a868aa1

    • SHA256

      ead20929594f6bfb4004c08c45c5567131d88abde650a2d2a87fbd3d441ddb98

    • SHA512

      00c4866cec9717ed0d470e9dcd257c92132c5707c3fb04c49788f7b59b5723c9ae212982cbdda70be56310ffb1cf40b10f84181b91eb213d0a8a7f3c6ddf6133

    • SSDEEP

      1536:k0d0prGh3Sh+apyRv3ERiPkYOSREd7AyF:k3Ga+HsDYOSR0L

    Score
    10/10
    asyncratpowermoneydiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      DEMANDA JUDICIAL ESPECIAL 13252548/VBoxRT.dll

    • Size

      4.0MB

    • MD5

      f8a2db04be8e882cf9e6474406c47daa

    • SHA1

      79b0eda0b60d748c16e34da56fa2aa23209cffcf

    • SHA256

      69a08ee425e52fd0bce474757a82f15ae1b355f8723cf4ebc03087d3fe4f6f05

    • SHA512

      03af1f8602484aab7b9275b75da56898e113cf4e125a5d190b5fd06d21d6a6c68c2ed61be3f74885c42b30e967ba83d5ee3243fcd79ef1ac2391aea215f72593

    • SSDEEP

      49152:lKNFpH8VfZqJru0K1kLo7RrObviwkZcrA2P16szn0uyIeOGTrLvQb8yQ7j:lVfZq+1kLRGIn0uy7wb8

    Score
    1/10
    behavioral3behavioral4

    • Target

      DEMANDA JUDICIAL ESPECIAL 13252548/msvcp100.dll

    • Size

      593KB

    • MD5

      4f096d96285e06cd51aef7d2d3de04da

    • SHA1

      c90ef0eb5b1a0b1b85ad6792291747fb6307dcdb

    • SHA256

      5bb420fbe28315f2117376052bb8488ce84a3398dda65005b8ae1f792017e9a8

    • SHA512

      80f558c50a71ad9c4930b3838b481e4fb453c38d57c91f7f70c1f86e4043b9a4fbcec27d7c025285504cbf3bde7c50b4770f18121d7818ac58e2ee9c2071f97c

    • SSDEEP

      12288:uoBFUsQ1H5FH3YUTd/dfePA7XrNvEKZm+aWodEEGblH6t2:LFUsQ1H5FHdggrNvEKZm+aWodEEIH6t2

    Score
    1/10
    behavioral5behavioral6

    • Target

      DEMANDA JUDICIAL ESPECIAL 13252548/msvcr100.dll

    • Size

      809KB

    • MD5

      df3ca8d16bded6a54977b30e66864d33

    • SHA1

      b7b9349b33230c5b80886f5c1f0a42848661c883

    • SHA256

      1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36

    • SHA512

      951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

    • SSDEEP

      12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks