General

  • Target

    33eaf3ff5016f2f7c62d27d6f735e9be.001

  • Size

    8.3MB

  • Sample

    241119-rp47msxbjc

  • MD5

    33eaf3ff5016f2f7c62d27d6f735e9be

  • SHA1

    b40eeca91ac71db5cac47c3382efa956a6a948f1

  • SHA256

    50d0d7ddbaeca0765f06901ef050fc76a30153fb804f59d804abf60135fdf0ae

  • SHA512

    1248a7d7571fb4d89493bc52d49182a01242424f68d06baaa05430cd72e6bbbb7f4e8d6c41d850d7a7a3b51bfb3affd6dae379a4708bbadcc884cf3ab2d74294

  • SSDEEP

    196608:ahhwnEVwaW10yiFPNAQfLgBHvcTGjXe1eMlzBaTiuAgh09hD2E:Ahl+UNnDg1ETGredl1PuAl9h

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

*** 19 NOV ***

C2

19nov2024.duckdns.org:9003

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO NUMERO DE RAD 456468 1531 6516 3213568 000 3546/QtCore4.dll

    • Size

      2.5MB

    • MD5

      14d40fbbb9f7da1a1b2f350b2ce557bc

    • SHA1

      8352f74e75753e28df1874fcf4e841e49aab9172

    • SHA256

      c84762d1bd4975173fcffc1cc27ef9289281061b97c39b6a300654c2293dfcf7

    • SHA512

      e9e36bf39ece517c5af551414de84f8033e90265e0e97f4f7edf23f47540c5f8c019b501847b56d4c0095d8470b0f58c7871089b06eed68a50d9dcedf864fe07

    • SSDEEP

      49152:YTFgiFpGXOENKpgjGkJsv6tWKFdu9C6TELyvL/6mShMZtmjNUVrciV5P+7QVg07+:Y+iDahjxJsv6tWKFdu9CZgfd

    Score
    3/10
    • Target

      NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO NUMERO DE RAD 456468 1531 6516 3213568 000 3546/QtGui4.dll

    • Size

      8.2MB

    • MD5

      831ba3a8c9d9916bdf82e07a3e8338cc

    • SHA1

      6c89fd258937427d14d5042736fdfccd0049f042

    • SHA256

      d2c8c8b6cc783e4c00a5ef3365457d776dfc1205a346b676915e39d434f5a52d

    • SHA512

      beda57851e0e3781ece1d0ee53a3f86c52ba99cb045943227b6c8fc1848a452269f2768bf4c661e27ddfbe436df82cfd1de54706d814f81797a13fefec4602c5

    • SSDEEP

      98304:YxRJATZlLne1/cF6ZWHxD1HFH+J+70msIWeiLtRgi3d4PJpTcSqxyr:YxiZBG2xpljTcJy

    Score
    3/10
    • Target

      NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO NUMERO DE RAD 456468 1531 6516 3213568 000 3546/QtNetwork4.dll

    • Size

      1.0MB

    • MD5

      8a2e025fd3ddd56c8e4f63416e46e2ec

    • SHA1

      5f58feb11e84aa41d5548f5a30fc758221e9dd64

    • SHA256

      52ae07d1d6a467283055a3512d655b6a43a42767024e57279784701206d97003

    • SHA512

      8e3a449163e775dc000e9674bca81ffabc7fecd9278da5a40659620cfc9cc07f50cc29341e74176fe10717b2a12ea3d5148d1ffc906bc809b1cd5c8c59de7ba1

    • SSDEEP

      12288:m+PpRNPe4+DZFvnwJ9o+Hllp59K03AskvvukLosiLHrv7F0YmIYunuGS:m+hRCZhwY+Hllp59OHvfo7HrCYmItnC

    Score
    3/10
    • Target

      NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO NUMERO DE RAD 456468 1531 6516 3213568 000 3546/QtWebKit4.dll

    • Size

      12.5MB

    • MD5

      a9fd9dd23c03aed462127ecc3e262590

    • SHA1

      a1e0c1dd566b54221a140103cb4443bb2f51decd

    • SHA256

      732ebca9428519f3f191047b166281b2f5b0495ce7b254c79f713526ca5869fd

    • SHA512

      80d955f0eb4ee48106766eec9e478630803c1b0df61f6dda8d44403f99b478d476a139e58dbb13f236aaa2412528d54f234a099395e6907ef39b59595bb08785

    • SSDEEP

      98304:NfyKJXPSGJ9opKMT/HSWmgskU9Kbrh0oHCXRm6fDh5dEDlxnZTZQFlNNN7wIcQ0U:NKmcpZ3sE/+oHCX82X+JxnmtcQ0

    Score
    3/10
    • Target

      NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO NUMERO DE RAD 456468 1531 6516 3213568 000 3546/ReFB.exe

    • Size

      80KB

    • MD5

      2a8613b7d99903516b8fe02fd820bf52

    • SHA1

      78a96addcb556ab1d490fac80f929305263d06b9

    • SHA256

      f1d68c5e7c7660d4f2ce412c109b7fe3e088872fa0ebe61ca9ab9dd92a496407

    • SHA512

      af0902aeb6169ea507b787da7b61c3533df4610c3f51c1d8f65dfc9008c8ce2580f2d86a49a4d0acc2c51c731f3e4c447d0d1d8e779dc1c75e43d30b79c46436

    • SSDEEP

      1536:9A8oAY5SXfidLez+Q+EGfdUHLLXJ+CqoVpPBucQwk7qnKXKo5OMY8xk03ben8TK:M7Ohz+Q+EGlUHLLXJ+CqoTPBucQwktXS

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    • Target

      NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO NUMERO DE RAD 456468 1531 6516 3213568 000 3546/msvcp100.dll

    • Size

      411KB

    • MD5

      03e9314004f504a14a61c3d364b62f66

    • SHA1

      0aa3caac24fdf9d9d4c618e2bbf0a063036cd55d

    • SHA256

      a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f

    • SHA512

      2fcff4439d2759d93c57d49b24f28ae89b7698e284e76ac65fe2b50bdefc23a8cc3c83891d671de4e4c0f036cef810856de79ac2b028aa89a895bf35abff8c8d

    • SSDEEP

      12288:iHEqYsrMWIqz473PTiPoH/aGhUgiW6QR7t5qv3Ooc8UHkC2eKq87:iH9YsIWIW4rPTiPofaDv3Ooc8UHkC2e8

    Score
    3/10
    • Target

      NOTIFICACIÓN ELECTRÓNICA AGRADECEMOS CONFIRMAR RECIBIDO NUMERO DE RAD 456468 1531 6516 3213568 000 3546/msvcr100.dll

    • Size

      752KB

    • MD5

      67ec459e42d3081dd8fd34356f7cafc1

    • SHA1

      1738050616169d5b17b5adac3ff0370b8c642734

    • SHA256

      1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067

    • SHA512

      9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33

    • SSDEEP

      12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks