General
-
Target
ORDER-210067.xls.exe
-
Size
1.2MB
-
Sample
210504-2ej6lzshm6
-
MD5
0afcb9f210ad0fbae66276f583a0d04b
-
SHA1
d26d65ae6cad14cbdeb1edfdca9d3eba3dee1c5c
-
SHA256
c7a647398282460a21fe3334a15d327c975c23cfdf4e08028c440b04b0404b73
-
SHA512
9aa577f488eca1846e8e10fae445164a03406189e65a8abd7a78f563af06999a0f1a97015da3cd008327ba125eacb421cf1352de6034e9ee6fbba64473b91b04
Static task
static1
Behavioral task
behavioral1
Sample
ORDER-210067.xls.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ORDER-210067.xls.exe
Resource
win10v20210410
Malware Config
Extracted
asyncrat
0.5.7B
chongmei33.publicvm.com:2703
chongmei33.publicvm.com:49746
chongmei33.publicvm.com:49703
chongmei33.publicvm.com:46943
185.165.153.116:2703
185.165.153.116:49746
185.165.153.116:49703
185.165.153.116:46943
54.37.36.116:2703
54.37.36.116:49746
54.37.36.116:49703
54.37.36.116:46943
185.244.30.92:2703
185.244.30.92:49746
185.244.30.92:49703
185.244.30.92:46943
dongreg202020.duckdns.org:2703
dongreg202020.duckdns.org:49746
dongreg202020.duckdns.org:49703
dongreg202020.duckdns.org:46943
178.33.222.241:2703
178.33.222.241:49746
178.33.222.241:49703
178.33.222.241:46943
rahim321.duckdns.org:2703
rahim321.duckdns.org:49746
rahim321.duckdns.org:49703
rahim321.duckdns.org:46943
79.134.225.92:2703
79.134.225.92:49746
79.134.225.92:49703
79.134.225.92:46943
37.120.208.36:2703
37.120.208.36:49746
37.120.208.36:49703
37.120.208.36:46943
178.33.222.243:2703
178.33.222.243:49746
178.33.222.243:49703
178.33.222.243:46943
87.98.245.48:2703
87.98.245.48:49746
87.98.245.48:49703
87.98.245.48:46943
AsyncMutex_6SI8OkPnk
-
aes_key
URB8HbE2qoPxdQcCDSu3DcXrIBKuvbaM
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
APP
-
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36,178.33.222.243,87.98.245.48
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
2703,49746,49703,46943
-
version
0.5.7B
Targets
-
-
Target
ORDER-210067.xls.exe
-
Size
1.2MB
-
MD5
0afcb9f210ad0fbae66276f583a0d04b
-
SHA1
d26d65ae6cad14cbdeb1edfdca9d3eba3dee1c5c
-
SHA256
c7a647398282460a21fe3334a15d327c975c23cfdf4e08028c440b04b0404b73
-
SHA512
9aa577f488eca1846e8e10fae445164a03406189e65a8abd7a78f563af06999a0f1a97015da3cd008327ba125eacb421cf1352de6034e9ee6fbba64473b91b04
Score10/10-
Async RAT payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-