General

  • Target

    Estado_Legal.N°8366723..exe

  • Size

    3.6MB

  • Sample

    241101-vsg33avkfm

  • MD5

    b1bedb0da4d8ac6629fa5c565788f299

  • SHA1

    170c2308092053a57af5ea06477fb4338c7e792a

  • SHA256

    6322d14ec5869367ae5b64fa81eb5958371640fdaa0dac6d5dcdfea35925cf94

  • SHA512

    5b0f8af764d8431218894eba38378b16faa300f867a8e54e71cd4372d8f97528d60d47d133918ce5ae9a4c4208fb6df2804f0676208d5037a4be16d6f40349c1

  • SSDEEP

    49152:tWGtLBcXqckrR6SVb8kq4pgquLMMji4NYxtJpkxhGjI4Tbm333geTIhiqyANPDLN:3tLuBVqgwh4NYxtJpkxhG0333geTKJvZ

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Solo-Domi-Oros

C2

procesosespeciales855.casacam.net:8853

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Estado_Legal.N°8366723..exe

    • Size

      3.6MB

    • MD5

      b1bedb0da4d8ac6629fa5c565788f299

    • SHA1

      170c2308092053a57af5ea06477fb4338c7e792a

    • SHA256

      6322d14ec5869367ae5b64fa81eb5958371640fdaa0dac6d5dcdfea35925cf94

    • SHA512

      5b0f8af764d8431218894eba38378b16faa300f867a8e54e71cd4372d8f97528d60d47d133918ce5ae9a4c4208fb6df2804f0676208d5037a4be16d6f40349c1

    • SSDEEP

      49152:tWGtLBcXqckrR6SVb8kq4pgquLMMji4NYxtJpkxhGjI4Tbm333geTIhiqyANPDLN:3tLuBVqgwh4NYxtJpkxhG0333geTKJvZ

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks