General

  • Target

    94a6db989c7b1e1ef9e3331171eb4c2c.rar

  • Size

    943KB

  • Sample

    241018-s7rvpsvdpb

  • MD5

    94a6db989c7b1e1ef9e3331171eb4c2c

  • SHA1

    7ef28db7f05d338055fea44ffb8ed15503c9ee35

  • SHA256

    6456825e433ad5aee331a9f3b45c29d0dd4404b67ab2264cf51755d040a1d372

  • SHA512

    6ac9ce8249c4cdca0f3b2c90f80ae8c1fda8bfcc7a637a6650930476030dfb5be9e01feaf6184237b87ca37cacab5915bbacc9615c932fd58e58305b9ff77898

  • SSDEEP

    24576:Ia5SLUksEHS4JImyRSnOjEpJwLi0OWinU7r7J/:Ia5UXsEkEPUUWinUbl

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

MAXIMO9

C2

delonuevomision.con-ip.com:2625

Mutex

tempcookiee

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ACTO ADMINISTRATIVO No. 0216_SANCIÓN POR RESOLUCIÓN.pdf.exe

    • Size

      971KB

    • MD5

      a6aca7334109f9557e4e36bcb0636db9

    • SHA1

      0d48af64ab4ec6d5df3c3a3fd2e5d44ab63f1ad4

    • SHA256

      8adc74379b29818e3185b0e289a1bf15c23c5974b99bbeb73b2155e17fcb1c35

    • SHA512

      4247c3b5b782c7dd46bbfec37e805a35a3e982254754b6d7fe0d7c7abdc573f06dcef4dae6516b14278df7e8f0cc989e29d4b5907071cc7f8e8e019aff5f2e6d

    • SSDEEP

      24576:HGOm0UBEP0ucza/1IEzmyKSacHha7FZ5tHpVdbGIP1vn8nwm5vK:+y8utGx0ha7FZ5tHpVdd9Ewm5vK

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks