Overview

overview

10

Static

static

1

FICHERO 20...DA.exe

windows7-x64

10

FICHERO 20...DA.exe

windows10-2004-x64

10

FICHERO 20...ue.dll

windows7-x64

3

FICHERO 20...ue.dll

windows10-2004-x64

3

FICHERO 20...40.dll

windows7-x64

3

FICHERO 20...40.dll

windows10-2004-x64

3

FICHERO 20...40.dll

windows7-x64

3

FICHERO 20...40.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    305683b8f059a3ee9d61a2ebb78dac29.GZ

  • Size

    839KB

  • Sample

    241111-thttfatrhk

  • MD5

    305683b8f059a3ee9d61a2ebb78dac29

  • SHA1

    b3a1375523b9f9b599aef700e30d97c2c4a1a41a

  • SHA256

    a9b07bfc6bb69a5ab92ffa2801adb4aa601b4bd20453275761dce836d5cf183f

  • SHA512

    9cce037abce42eb83dea19bff7d8edc61d1da2b2d4cade5deaf748064652b6e8d34a2676158a661c7126c49b9dbe745840eb1ea9565264b853f474cba0b93e31

  • SSDEEP

    12288:+5lH3HpldjKPrwSNgZhwbId3iQX1cPWWa4PaXoR1vpxzM9FEAHlWy+s3+e:+L3Hr8TzQcwdDWTCXKvuFbHlWi3+e

Score
10/10
asyncratserverdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

SERVER

C2

asyfas.duckdns.org:52350

Mutex

AsyncMutex_6SI6TOGjnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      FICHERO 20200324- DEMANDA LABORAL_PROCESO JUDICIAL/1PROCESO DEMANDA.exe

    • Size

      275KB

    • MD5

      b2d4b1d83945b5787d49a86c4f394e0c

    • SHA1

      334a5c434e5d5d0649f8224e449ca9aaf9ba6816

    • SHA256

      038d7b257b98421ad371189cf51d67f32ddad2de687c443a59ea74e4027bbf04

    • SHA512

      4e92c367991a30d81a718ef26e8e61d24a84d2b54b5d9c6555f319b186ed5bc29d03fb10929bdae4d37c4fe92b3c0be63ee1ed4b287df74af7644e65053222d5

    • SSDEEP

      6144:fONaSHaPlcCgYH9oYAd6q2vACSHaPlcCgYH9oY8HJF:fe969RTHGkIF69RTH6F

    Score
    10/10
    asyncratserverdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      FICHERO 20200324- DEMANDA LABORAL_PROCESO JUDICIAL/mozglue.dll

    • Size

      194KB

    • MD5

      7404e6cc2d9f62c5e177c4635835a190

    • SHA1

      30b28ef884cf45a37c49cce8dbe6dcff540bce5f

    • SHA256

      330a56e3c9476794228aaea8eebf5cb9f8daef95fea79b6f8a400ff53cade354

    • SHA512

      2e55632e9badb5a69372897cd28927e498d33f603d7dbd7d0d34b3df3a1039e24184b0061b7b1d7420a0730d443df16fe239bcb77484a4602cc055fe4c4c732e

    • SSDEEP

      6144:y2IbQP+tRwQWlhAJRd6XcT4NJyFJNV34I64DTBoGMKayZ2JJJMpqmjJK:y2IbQMmjKgsT4NkD336QTWGM6pq6K

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      FICHERO 20200324- DEMANDA LABORAL_PROCESO JUDICIAL/msvcp140.dll

    • Size

      427KB

    • MD5

      ff877a5dffd764197250bd4ba28496b1

    • SHA1

      187b8e183fc3331dd4ba139333886ad1fbf333a7

    • SHA256

      83f935454ae8e450b6f042509ecf28cceff95edb2495c63a782b9d45c2eaf1c0

    • SHA512

      b9245353f8a8bce6f443345daf50e135aa9d84bcce4dc5fd9279216b99bc6a1fa409292e110132ad815f303f36006610d6907e9fc778e94977beb2332481d03d

    • SSDEEP

      12288:RvYnQwEk3eLow3WEfQ+yggQWvHzDvKhOKjDhUgiW6QR7t5s03Ooc8dHkC2esqg:9YnQwELow3WSyLQWvHzLKhOKQ03Ooc8a

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      FICHERO 20200324- DEMANDA LABORAL_PROCESO JUDICIAL/vcruntime140.dll

    • Size

      78KB

    • MD5

      1e6e97d60d411a2dee8964d3d05adb15

    • SHA1

      0a2fe6ec6b6675c44998c282dbb1cd8787612faf

    • SHA256

      8598940e498271b542f2c04998626aa680f2172d0ff4f8dbd4ffec1a196540f9

    • SHA512

      3f7d79079c57786051a2f7facfb1046188049e831f12b549609a8f152664678ee35ad54d1fff4447428b6f76bea1c7ca88fa96aab395a560c6ec598344fcc7fa

    • SSDEEP

      1536:FRk1rh/be3Z1bij+8xG+sQxzQF50I9VSHIecbWZOUXYOe0/zuvY:FRk/+Z1z8s+s+QrTmIecbWIA7//gY

    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks