General
-
Target
Cyup.exe
-
Size
377KB
-
Sample
220404-dwb8jshec2
-
MD5
723e85e9cd88b3ddaa1b44346ceeaf7d
-
SHA1
3da16366440b2a96dd92e583a55be819fe98191a
-
SHA256
756517220093a59e69e6db3de1846896d146600389f742503804f25ba6fa74dd
-
SHA512
328ba7a68b2fbfd44da652e7b0b7816716bcc70029739bdbae6dd803ee65e06f284bd12986caa9c72a87cbff8f835994c274bfafaa1c8ed13bc2e284ab47f1c5
Static task
static1
Behavioral task
behavioral1
Sample
Cyup.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
Cyup.exe
Resource
win10v2004-20220331-en
Malware Config
Extracted
asyncrat
0.5.7B
2
212.193.30.54:9524
wyQ92!.,=FT72few
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
Cyup.exe
-
Size
377KB
-
MD5
723e85e9cd88b3ddaa1b44346ceeaf7d
-
SHA1
3da16366440b2a96dd92e583a55be819fe98191a
-
SHA256
756517220093a59e69e6db3de1846896d146600389f742503804f25ba6fa74dd
-
SHA512
328ba7a68b2fbfd44da652e7b0b7816716bcc70029739bdbae6dd803ee65e06f284bd12986caa9c72a87cbff8f835994c274bfafaa1c8ed13bc2e284ab47f1c5
Score10/10-
Async RAT payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-