General
-
Target
Geno_Quotation,pdf.exe
-
Size
929KB
-
Sample
210113-kz1sa51fyn
-
MD5
fbf75396fc5ed9d7555effe393035109
-
SHA1
be62388c45754b3497e8eda1d501031fa2ca7cbf
-
SHA256
77cc0ec039c99a695a94081d8462ee42b5b526a1da92bf05c65f3ff8fd40ec0c
-
SHA512
7069b9080b288bb292fdd6fc513a3c9ac40593bc63b2631ff7214256999455369379e0e05deeabe6139bd65964db37cace8ecb1c23853496340f77e663fe5671
Static task
static1
Behavioral task
behavioral1
Sample
Geno_Quotation,pdf.exe
Resource
win7v20201028
Malware Config
Extracted
asyncrat
0.5.7B
null:null
AsyncMutex_6SI8OkPnk
-
aes_key
yFdiISTMNVqtdBU1VShPLhZnkF6gdamp
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
billion
-
host
null
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
https://pastebin.com/raw/Q5Dxj1fY
-
port
null
-
version
0.5.7B
Targets
-
-
Target
Geno_Quotation,pdf.exe
-
Size
929KB
-
MD5
fbf75396fc5ed9d7555effe393035109
-
SHA1
be62388c45754b3497e8eda1d501031fa2ca7cbf
-
SHA256
77cc0ec039c99a695a94081d8462ee42b5b526a1da92bf05c65f3ff8fd40ec0c
-
SHA512
7069b9080b288bb292fdd6fc513a3c9ac40593bc63b2631ff7214256999455369379e0e05deeabe6139bd65964db37cace8ecb1c23853496340f77e663fe5671
-
Async RAT payload
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-