General
-
Target
f9a44df47feacc5266129596473c529f546f57df2954134494794cc8aa812602
-
Size
5KB
-
Sample
230101-hzzkgabc73
-
MD5
4c2221d1f044ceae8fb1e6a23ca80cc2
-
SHA1
4f498f2f44a8f1ecca3475afef3b8a683f695718
-
SHA256
f9a44df47feacc5266129596473c529f546f57df2954134494794cc8aa812602
-
SHA512
aefe135fec54cda97aeb06c5973927423b4f4683f38502ed7ded86b95ff429e8643a7b129e0656865a0a251f487704db21ac601c96b980b3ae73ba64513eb6e4
-
SSDEEP
96:979WKCFpMDflWtktvk+aQsJAYQskvk+atGMLvud3ojqYrl:V9WRFpwlWKvkc9YQvkhGwudjc
Static task
static1
Behavioral task
behavioral1
Sample
f9a44df47feacc5266129596473c529f546f57df2954134494794cc8aa812602.exe
Resource
win10-20220901-en
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Targets
-
-
Target
f9a44df47feacc5266129596473c529f546f57df2954134494794cc8aa812602
-
Size
5KB
-
MD5
4c2221d1f044ceae8fb1e6a23ca80cc2
-
SHA1
4f498f2f44a8f1ecca3475afef3b8a683f695718
-
SHA256
f9a44df47feacc5266129596473c529f546f57df2954134494794cc8aa812602
-
SHA512
aefe135fec54cda97aeb06c5973927423b4f4683f38502ed7ded86b95ff429e8643a7b129e0656865a0a251f487704db21ac601c96b980b3ae73ba64513eb6e4
-
SSDEEP
96:979WKCFpMDflWtktvk+aQsJAYQskvk+atGMLvud3ojqYrl:V9WRFpwlWKvkc9YQvkhGwudjc
Score10/10-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-