General
-
Target
invoicedHusrLjViL.scr
-
Size
927KB
-
Sample
210119-yl3cmgat8a
-
MD5
d1084928e426106d30ddea51fbedae58
-
SHA1
c372ab627e0da8f59fc31b212e472deda3c460db
-
SHA256
c5f444d3e3808d7323e4beabeeb3fd254fc9b458157aea384873fd1dbc059e82
-
SHA512
18032750943e809d6f2e26df13dcdad2974d511d0f4b1f9bc80a4b967b98f935eb8d77a780c03c48e89048f4f9d057b17153ad76dc429f68a64596528cc0b701
Static task
static1
Behavioral task
behavioral1
Sample
invoicedHusrLjViL.scr
Resource
win7v20201028
Malware Config
Extracted
asyncrat
0.5.6D
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
79.134.225.32:6606
79.134.225.32:7707
79.134.225.32:8808
79.134.225.26:6606
79.134.225.26:7707
79.134.225.26:8808
oywtgyvevvz
-
aes_key
16aJR1kH3oClchyvB6t5W12YTsX5nnFa
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
CASHAPP
-
host
127.0.0.1,79.134.225.32,79.134.225.26
-
hwid
11
- install_file
-
install_folder
%AppData%
-
mutex
oywtgyvevvz
-
pastebin_config
null
-
port
6606,7707,8808
-
version
0.5.6D
Targets
-
-
Target
invoicedHusrLjViL.scr
-
Size
927KB
-
MD5
d1084928e426106d30ddea51fbedae58
-
SHA1
c372ab627e0da8f59fc31b212e472deda3c460db
-
SHA256
c5f444d3e3808d7323e4beabeeb3fd254fc9b458157aea384873fd1dbc059e82
-
SHA512
18032750943e809d6f2e26df13dcdad2974d511d0f4b1f9bc80a4b967b98f935eb8d77a780c03c48e89048f4f9d057b17153ad76dc429f68a64596528cc0b701
-
Async RAT payload
-
Suspicious use of SetThreadContext
-