General

  • Target

    Notifica Demanda Ref. 25421208-2024 Admite Juzgado Civil.exe

  • Size

    2.0MB

  • Sample

    241101-rjnmpszlgs

  • MD5

    3d688bdc32ca1df6570115284247a661

  • SHA1

    9e65416d36b4c54f28be49b9b88846a426111aa0

  • SHA256

    6804e81b25e4ce4a13a794265d81f17e975119f0298f8bc1bab6e32ef68e96ed

  • SHA512

    3b41c9fe21a3973198fe2d4f58f153f2113da861892557b5cdaf7ead410cf48702946422873a90260ac9f6ab3bd17e5d9d9b3329c7fd0a0bc026d3c181f9cc91

  • SSDEEP

    49152:2S2EcnQUXj6SELV6HKcnkkdK9lQJhXfpCMmydLw9d5Oeqlt/IdMWRtpiFTm02t2m:oXV5gdswN/CjKb

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

OCTU30

C2

mjjhfyftuf.duckdns.org:8010

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Notifica Demanda Ref. 25421208-2024 Admite Juzgado Civil.exe

    • Size

      2.0MB

    • MD5

      3d688bdc32ca1df6570115284247a661

    • SHA1

      9e65416d36b4c54f28be49b9b88846a426111aa0

    • SHA256

      6804e81b25e4ce4a13a794265d81f17e975119f0298f8bc1bab6e32ef68e96ed

    • SHA512

      3b41c9fe21a3973198fe2d4f58f153f2113da861892557b5cdaf7ead410cf48702946422873a90260ac9f6ab3bd17e5d9d9b3329c7fd0a0bc026d3c181f9cc91

    • SSDEEP

      49152:2S2EcnQUXj6SELV6HKcnkkdK9lQJhXfpCMmydLw9d5Oeqlt/IdMWRtpiFTm02t2m:oXV5gdswN/CjKb

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks