General
-
Target
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
-
Size
63KB
-
Sample
221212-vwnd9aca47
-
MD5
ead6a22a37b96bcbae4faa07f79e6602
-
SHA1
3f5f172e83185d402e030ce0e95185fb64c2b208
-
SHA256
650ce0611e51d1a7aa28943d1a9a974e4803093287bf13f9b1e612345ebdf8ff
-
SHA512
69ca44a5d053c51549f14246e1b714ea2eb75c37d86e5501f9d0588653c4927d8ca814ae10469dd21ac6183647103a00459ba35847ac7302c20805e959588eb8
-
SSDEEP
1536:fThA4fjgyCZ78D+iCTuo8hM5zPAB4zOCW3YDz3Ak1:f99rgRZn8WFPAB4qCAYfAk1
Static task
static1
Behavioral task
behavioral1
Sample
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Targets
-
-
Target
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
-
Size
87KB
-
MD5
ca699117112a173ca7b289f1baf6c3c0
-
SHA1
862f227d4fa0b4de892006d7fe19e610e9f1a676
-
SHA256
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
-
SHA512
d9f82f6e18ce2eb624a5ee1e20618318fde7ffdcff834d9c0291f4971bd72ce9b7f5108bf45f11ceed4d1f526bad4842913e833a25e3d99a3235d6f87b4d2620
-
SSDEEP
1536:sUZggDGVM9WSZvZHU+uyWrHyHndw/VTtvVCMI4bgAQ9uaJZA2DJpO:sUigDGVMU4vZUZJmHdeVTtI4bgAQ9uaE
Score10/10-
Async RAT payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-