General

  • Target

    DOCUMENTOS Y ANEXOS LLEVADOS PARA DETALLES DE PROCESO, SOLICITUD DE CONTRASEÑA 81293743.rar

  • Size

    937KB

  • Sample

    241029-1h8e6azhnr

  • MD5

    380a1652fdc116f0ace539d76e63ca08

  • SHA1

    a13e911d28261140d6decdeaba45ffcd39d09966

  • SHA256

    8a3c8e103ed2437b33fbd78c228e2d1cda79516dd7fd7fef35993ad2c8bcd447

  • SHA512

    d07f7c457687b073ca82b70142ecdd7318e3d8114091c1bb7d62e4e623f35409fe65f363897e3e90341a6fc1cfd83254aae9730f699fe40ba449ab29f5ba3c17

  • SSDEEP

    24576:w7oLGslJrP8wOUom1iNuhaClw9672wi30aP6zNPCkBEWFRx/Thn:CoigrPxObhuXu96760Ff9xB

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

COMIENZA02

C2

comienza02.duckdns.org:7707

Mutex

uuooxuxbnkywum

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      DOCUMENTOS Y ANEXOS LLEVADOS PARA DETALLES DE PROCESO, SOLICITUD DE CONTRASEÑA 81293743.rar

    • Size

      937KB

    • MD5

      380a1652fdc116f0ace539d76e63ca08

    • SHA1

      a13e911d28261140d6decdeaba45ffcd39d09966

    • SHA256

      8a3c8e103ed2437b33fbd78c228e2d1cda79516dd7fd7fef35993ad2c8bcd447

    • SHA512

      d07f7c457687b073ca82b70142ecdd7318e3d8114091c1bb7d62e4e623f35409fe65f363897e3e90341a6fc1cfd83254aae9730f699fe40ba449ab29f5ba3c17

    • SSDEEP

      24576:w7oLGslJrP8wOUom1iNuhaClw9672wi30aP6zNPCkBEWFRx/Thn:CoigrPxObhuXu96760Ff9xB

    Score
    1/10
    • Target

      DOCUMENTOS Y ANEXOS LLEVADOS PARA DETALLES DE PROCESO, SOLICITUD DE CONTRASEÑA 81293743094286931243546358.exe

    • Size

      953KB

    • MD5

      1a6e0f6f60a33c2cac57c9e42b503149

    • SHA1

      012bbeb630bda308f1160e858af16f979a0b5bf3

    • SHA256

      6add84ed284948ad9ba960719a43da930e2d54ac1e519b66d14f40aa1101f4ed

    • SHA512

      ca48c7dc97ef3bdcaef24638ab5a2abeb28c8b6bc1164e5ba0a57bfde0fe82f4b97c9a3daa6485c23df2f86427f761730f3f810f68b843df00546cbe65247031

    • SSDEEP

      24576:zcrtvtxICvbBVNgiB39jXagAwjEeFIni5bFDe+yOGmZoaa:At3TBVNgiB39jXKwj9aneFyS0

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks