General
-
Target
558ced74df141e2e8f4a340edccd5e16.js.vir
-
Size
197KB
-
Sample
220703-er7z4aegbq
-
MD5
308d7ff7f284eed50cb29aedc8f3bb48
-
SHA1
3cf054753beb7c857c198b5def3804e29f3426ff
-
SHA256
380afcca7c0cfc3e015be647a0b46fa4a2b56a213d8428db3a6503a737b2a0f9
-
SHA512
c393d34572c134d6ad6bb7b90598d04275f08f00b51d6acd2d4709df2460fe67ea347e4cd0baf8134cac9d776721f627601ea8ca9599147965220435cabac0be
Static task
static1
Behavioral task
behavioral1
Sample
558ced74df141e2e8f4a340edccd5e16.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
558ced74df141e2e8f4a340edccd5e16.js
Resource
win10v2004-20220414-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Targets
-
-
Target
558ced74df141e2e8f4a340edccd5e16.js.vir
-
Size
197KB
-
MD5
308d7ff7f284eed50cb29aedc8f3bb48
-
SHA1
3cf054753beb7c857c198b5def3804e29f3426ff
-
SHA256
380afcca7c0cfc3e015be647a0b46fa4a2b56a213d8428db3a6503a737b2a0f9
-
SHA512
c393d34572c134d6ad6bb7b90598d04275f08f00b51d6acd2d4709df2460fe67ea347e4cd0baf8134cac9d776721f627601ea8ca9599147965220435cabac0be
Score10/10-
Async RAT payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-