General
-
Target
65b748276b7dea04af2f7f40ca1d08a1395c0de73734c82c581953b9213dc1a9
-
Size
107KB
-
Sample
220521-ntt1paebc4
-
MD5
7eb5ac82b172bf7ff3b2b0b810d75268
-
SHA1
bb8e2ada4f255b169e95c3f700b55a801ffb67ea
-
SHA256
65b748276b7dea04af2f7f40ca1d08a1395c0de73734c82c581953b9213dc1a9
-
SHA512
0f465a943a490600851d5dbab70e52dfb2c589bb8386a26e5d754c677f7bdeabbbe1874b4a3d05a842c4ebfc0ef650c539cc81bd57629096e458f6fbef41b749
Static task
static1
Behavioral task
behavioral1
Sample
Doc#662020094753525765678.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Doc#662020094753525765678.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
asyncrat
0.5.7B
DIRECT
chizzy25@@!7^UPCAZ
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/HKYwiN9V
Targets
-
-
Target
Doc#662020094753525765678.exe
-
Size
301KB
-
MD5
9b70f0dee9fa7de571b2c08a6f3a9a75
-
SHA1
f3ad5f3cabe73c60c795c3367faaca682ddc1cc9
-
SHA256
249b086fbb970eefa5bc4c9bcebcda1e8a638ed82a1bbf1a106cfe3807e3e121
-
SHA512
2d47ea2d01e5643e5e5bec7e4b44e2c6cbc5c69f233bef27def943343403733a484baa58b90699f8ca29be52086750d505c47d876f8076ca363797be2f5badd7
Score10/10-
Async RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-