General

  • Target

    788ed4f6166416af9bda70d6e5064a2d4e2ad0f03cc1a1ee646b41dd8038999a

  • Size

    10.0MB

  • Sample

    241122-cnajbayjgm

  • MD5

    a0c93f25f5cab7d7843c8a75d8ef2baa

  • SHA1

    d180f3ede64b07da0884a3840ded374bd1594aaa

  • SHA256

    788ed4f6166416af9bda70d6e5064a2d4e2ad0f03cc1a1ee646b41dd8038999a

  • SHA512

    9faf73a13e5e8ed1a31bdc4292f39c3e35313f47e729e054dfb8c8c72035ed53744d8fedba48bfb992986ad021443dcda8f59936079d90695a13fb4ef45484d9

  • SSDEEP

    24576:YaZwmO1/zNeHASYzwkvKeKXLH1wQ2C3ygq2mk6ty:umO1/zcAS0fv02gqW

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

BB

C2

noviembre07.ydns.eu:2525

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      788ed4f6166416af9bda70d6e5064a2d4e2ad0f03cc1a1ee646b41dd8038999a

    • Size

      10.0MB

    • MD5

      a0c93f25f5cab7d7843c8a75d8ef2baa

    • SHA1

      d180f3ede64b07da0884a3840ded374bd1594aaa

    • SHA256

      788ed4f6166416af9bda70d6e5064a2d4e2ad0f03cc1a1ee646b41dd8038999a

    • SHA512

      9faf73a13e5e8ed1a31bdc4292f39c3e35313f47e729e054dfb8c8c72035ed53744d8fedba48bfb992986ad021443dcda8f59936079d90695a13fb4ef45484d9

    • SSDEEP

      24576:YaZwmO1/zNeHASYzwkvKeKXLH1wQ2C3ygq2mk6ty:umO1/zcAS0fv02gqW

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks