General

  • Target

    9f4253bf0f732ccb4fda21095a106c47c147fd3322aa2f646671210c77bf7916.exe

  • Size

    1.1MB

  • Sample

    241129-x6f42axjam

  • MD5

    0d954025a427a68daaba3ffcdbea1429

  • SHA1

    36a2b10db5d1007a1ad050b9fa42ba9ca4006bbc

  • SHA256

    9f4253bf0f732ccb4fda21095a106c47c147fd3322aa2f646671210c77bf7916

  • SHA512

    16069f5d311b78ad31933c35591fa3d67e5d7992c50fd3d549768f93b20e8fe14522c0dac622a67e0101896161c4f9546198606ab62a9e9bad119f332614129e

  • SSDEEP

    24576:YaZwmO1/zNeHASYzwkvKeKXLH1wQ2C3ygq2mk6tyl:umO1/zcAS0fv02gqWl

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

BB

C2

noviembre07.ydns.eu:2525

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      9f4253bf0f732ccb4fda21095a106c47c147fd3322aa2f646671210c77bf7916.exe

    • Size

      1.1MB

    • MD5

      0d954025a427a68daaba3ffcdbea1429

    • SHA1

      36a2b10db5d1007a1ad050b9fa42ba9ca4006bbc

    • SHA256

      9f4253bf0f732ccb4fda21095a106c47c147fd3322aa2f646671210c77bf7916

    • SHA512

      16069f5d311b78ad31933c35591fa3d67e5d7992c50fd3d549768f93b20e8fe14522c0dac622a67e0101896161c4f9546198606ab62a9e9bad119f332614129e

    • SSDEEP

      24576:YaZwmO1/zNeHASYzwkvKeKXLH1wQ2C3ygq2mk6tyl:umO1/zcAS0fv02gqWl

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks