General

  • Target

    3ccacfb8accb6c350caeea67e9f425488837a4b424ff76bd195d62452dd6e4e4

  • Size

    1017KB

  • Sample

    241120-rsw1fayjaw

  • MD5

    938653d01f87de709153a10e455ebb8a

  • SHA1

    547e50eb0f492b0bcf37343f40f635c167cd5b7a

  • SHA256

    3ccacfb8accb6c350caeea67e9f425488837a4b424ff76bd195d62452dd6e4e4

  • SHA512

    5e6d7506b64ccab882b16bc0afa00d08ff9c5256f60801d4e978509ef8afe3ef43e1134d45e5fc5a0af0ce7e985e60e3b63639157be3adcd4abfbd8150ef5859

  • SSDEEP

    24576:eKI7etHLvLqhHb8LAKdqWDMlZ17RRS685GykIMpc5:k6tXqhHbiAKdqWDMlZlUr

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

ORO

C2

noviembre07.ydns.eu:2525

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      3ccacfb8accb6c350caeea67e9f425488837a4b424ff76bd195d62452dd6e4e4

    • Size

      1017KB

    • MD5

      938653d01f87de709153a10e455ebb8a

    • SHA1

      547e50eb0f492b0bcf37343f40f635c167cd5b7a

    • SHA256

      3ccacfb8accb6c350caeea67e9f425488837a4b424ff76bd195d62452dd6e4e4

    • SHA512

      5e6d7506b64ccab882b16bc0afa00d08ff9c5256f60801d4e978509ef8afe3ef43e1134d45e5fc5a0af0ce7e985e60e3b63639157be3adcd4abfbd8150ef5859

    • SSDEEP

      24576:eKI7etHLvLqhHb8LAKdqWDMlZ17RRS685GykIMpc5:k6tXqhHbiAKdqWDMlZlUr

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks