General
-
Target
e0ff85b978c48f247b89eed15d8b0eea
-
Size
448KB
-
Sample
220314-y7vjgsebck
-
MD5
e0ff85b978c48f247b89eed15d8b0eea
-
SHA1
0cd3084933e0bb4cb68f0b1843ac8d31690798da
-
SHA256
35fd92f42dd1700e15f8889c73604ec0c005cd9d1d1e30adb6d439091e58f464
-
SHA512
fd7e8acb5bb8196a8b3abda369a8171fd6c5c052b4fffc39ffc75c49ac846e9c43481fd85577316d8827e4208121ceda3ece7fd7b0ab7e4a1ce1302cb9034e25
Static task
static1
Behavioral task
behavioral1
Sample
e0ff85b978c48f247b89eed15d8b0eea.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
e0ff85b978c48f247b89eed15d8b0eea.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
asyncrat
0.5.7B
2
212.193.30.54:9524
wyQ92!.,=FT72few
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Targets
-
-
Target
e0ff85b978c48f247b89eed15d8b0eea
-
Size
448KB
-
MD5
e0ff85b978c48f247b89eed15d8b0eea
-
SHA1
0cd3084933e0bb4cb68f0b1843ac8d31690798da
-
SHA256
35fd92f42dd1700e15f8889c73604ec0c005cd9d1d1e30adb6d439091e58f464
-
SHA512
fd7e8acb5bb8196a8b3abda369a8171fd6c5c052b4fffc39ffc75c49ac846e9c43481fd85577316d8827e4208121ceda3ece7fd7b0ab7e4a1ce1302cb9034e25
Score10/10-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-