Overview

overview

10

Static

static

3

2024-12-12...id.exe

windows7-x64

10

2024-12-12...id.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-12-12_2f6ff8ef5c26593f4d3eb024cd8fa050_icedid

  • Size

    1.9MB

  • Sample

    241212-nx5llasrcw

  • MD5

    2f6ff8ef5c26593f4d3eb024cd8fa050

  • SHA1

    1ed85fbd549e9b7864c6e1ea7e73bf3da1a8f0f6

  • SHA256

    7a46ef094ced0de01d6a2c2727ad015248f78eeb364a0af1e9cb0038942639ad

  • SHA512

    f88567b91bb2681336a9dfd688911d9d58d804e1f239b4d7164f7bcd835efd173d76bacd6336ea3cfd0798a347fe9f14c5772ea9eb023229e22d25d291435001

  • SSDEEP

    24576:2jmc9/6Am6l0ikrNLKPXeiNuNLUZF1hKnGDDSo0uBGz:2p/h4rNcXeiNuNwZVKnGSow

Score
10/10
asyncratdicembrinos11discoverypersistencerat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Dicembrinos11

C2

cascam12.casacam.net:8855

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      2024-12-12_2f6ff8ef5c26593f4d3eb024cd8fa050_icedid

    • Size

      1.9MB

    • MD5

      2f6ff8ef5c26593f4d3eb024cd8fa050

    • SHA1

      1ed85fbd549e9b7864c6e1ea7e73bf3da1a8f0f6

    • SHA256

      7a46ef094ced0de01d6a2c2727ad015248f78eeb364a0af1e9cb0038942639ad

    • SHA512

      f88567b91bb2681336a9dfd688911d9d58d804e1f239b4d7164f7bcd835efd173d76bacd6336ea3cfd0798a347fe9f14c5772ea9eb023229e22d25d291435001

    • SSDEEP

      24576:2jmc9/6Am6l0ikrNLKPXeiNuNLUZF1hKnGDDSo0uBGz:2p/h4rNcXeiNuNwZVKnGSow

    Score
    10/10
    asyncratdicembrinos11discoverypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks