General
-
Target
goodbye.ps1
-
Size
7.7MB
-
Sample
220926-zafjqsbhh3
-
MD5
76cb211a39e29bd567554bdf1f2ee63c
-
SHA1
59e4aa84771e257ccc1e1e1db35608aa9bec9fc8
-
SHA256
19ee843d37c1586e9058ff1f09c7e7c27da7ae568d44e1c95387b3f851d0c3eb
-
SHA512
eb0f3858c63c8448ef17bdd8b385cda7596394d6d3a3f0c128a894ce7664fdd45e5a0b83b93ee6557bc78a1f05ae38a4910beb9c61e7f57ce8e84a294470d5f8
-
SSDEEP
24576:cfn0m/OPb9o/Ha4KZZQLFq487s/0H+VXQ5qDrtj6Bnoi4LD2/Qy4IyQr+KJn04vd:x
Static task
static1
Behavioral task
behavioral1
Sample
goodbye.ps1
Resource
win7-20220901-en
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Default
worldpassed.publicvm.com:199
AsyncMutex_6SI8OkBrC
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
goodbye.ps1
-
Size
7.7MB
-
MD5
76cb211a39e29bd567554bdf1f2ee63c
-
SHA1
59e4aa84771e257ccc1e1e1db35608aa9bec9fc8
-
SHA256
19ee843d37c1586e9058ff1f09c7e7c27da7ae568d44e1c95387b3f851d0c3eb
-
SHA512
eb0f3858c63c8448ef17bdd8b385cda7596394d6d3a3f0c128a894ce7664fdd45e5a0b83b93ee6557bc78a1f05ae38a4910beb9c61e7f57ce8e84a294470d5f8
-
SSDEEP
24576:cfn0m/OPb9o/Ha4KZZQLFq487s/0H+VXQ5qDrtj6Bnoi4LD2/Qy4IyQr+KJn04vd:x
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-