asyncrat

General

Target

TF814BG.TBZ2
Size

8.6MB
Sample

241022-wepfnazapm
MD5

531993262de095bb38e55e9f317ef408
SHA1

be17b17da93d42ff349a71c7a5de230aad37f2e0
SHA256

8cac130cafde6f93de3f1b09de9c223d88da8a565de6755b03548a9f76bb5147
SHA512

8648440226181b3bfb7f25feb6b30d4e93f1712ff27ec0f89ebedca818f9c2dbf9c5c8d8495ba38e0e6711276c54e046cd9e3a4fcd82e530a2def393555cae84
SSDEEP

196608:Xmef1wvzRjnx/izRU91VqIhfmRF6CGMdkbKFcFXzClIg2SSqx1XmttX:b18Bnx/itGGzGMdW4Ig2p62ttX

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

C2

envio122344.duckdns.org:3030

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  
  00542-INICIO DEMANDA LABORAL JUZGADO 02 PENAL DE CIRCUITO DE RAMA JUDICIAL/01 DEMANDA LABORAL.exe
- Size
  
  304KB
- MD5
  
  411cd1175b5e21b6a3c6a72c34e8773c
- SHA1
  
  faabd22ddca0062dd3d7bc534e49078ee5d84be8
- SHA256
  
  116b75d94dacf676931ff8623a0b34f3ea75b52d67b0494fefd1b8dce6bc121a
- SHA512
  
  6414d174a17edf813bb7f739b9d625c4489dd4a45c56932fad7f222a2b8ea646fd2316cdba4e421225cbdf4aeb245329aa5bb3034e2b54e3859dcd89c7d1dd90
- SSDEEP
  
  6144:VU1bbTLUcplb/PBA107iUJokz0HYmHvt9mC1xuhB0KY+c5+ZUkBgtPog/BCRs0p:61bwcpNPX+UJok4TvtsQxeo+c5+tBYPc
Score

10^/10

asyncrat default discovery rat upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2