General

  • Target

    SecuriteInfo.com.Variant.Tedy.208461.30032.2131.exe

  • Size

    15KB

  • Sample

    220929-gxlp6abacr

  • MD5

    e7644a6fcfc72a0fc203d65e789864b9

  • SHA1

    f44537827c953074f073f95a874b1e73e3aa9108

  • SHA256

    8752e7458cba6116a189e583e1abdc2336b89381e74f9d187b2eee8411db8329

  • SHA512

    714edabec5a68acbfb5156616bf015304e66723de271c20d5ecd6fc9477f707e036206df3e98bf992e9407ff01919258b586b597836dfd7dd715c20165685115

  • SSDEEP

    384:XLfM5gFNTDeYyvJJrw7sUC/OntmeEuToyM:7TFNvlyvJJrcsUC/OtVEuT2

Malware Config

Targets

    • Target

      SecuriteInfo.com.Variant.Tedy.208461.30032.2131.exe

    • Size

      15KB

    • MD5

      e7644a6fcfc72a0fc203d65e789864b9

    • SHA1

      f44537827c953074f073f95a874b1e73e3aa9108

    • SHA256

      8752e7458cba6116a189e583e1abdc2336b89381e74f9d187b2eee8411db8329

    • SHA512

      714edabec5a68acbfb5156616bf015304e66723de271c20d5ecd6fc9477f707e036206df3e98bf992e9407ff01919258b586b597836dfd7dd715c20165685115

    • SSDEEP

      384:XLfM5gFNTDeYyvJJrw7sUC/OntmeEuToyM:7TFNvlyvJJrcsUC/OtVEuT2

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks