General
-
Target
55487eb6fbadb3219f43c53fc13b823f0574df2c50c5db7b1836bbe4160bff4e
-
Size
5KB
-
Sample
230119-hw34gscc7w
-
MD5
d3e502a774b789443939e8e097a1d518
-
SHA1
ca6b8e034fe529616f227ee932a567e0d1b467ba
-
SHA256
55487eb6fbadb3219f43c53fc13b823f0574df2c50c5db7b1836bbe4160bff4e
-
SHA512
e5d9022573cea5a8cf2ed72ff5267f7c35c6ddb7771746d123d5aede37daa5808f27a23dc8f14491837fdf8a6f7e90e94800fe04a36cf555527a6d305e87a8fd
-
SSDEEP
96:sosZ79Y63L1bhycf6mAa3aDFUUqIS8t1NtUqMSSavvqd3ojWrl:Kp9Y63L1bhycTWuUqIl3NtUqMSxqdr
Static task
static1
Behavioral task
behavioral1
Sample
55487eb6fbadb3219f43c53fc13b823f0574df2c50c5db7b1836bbe4160bff4e.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Targets
-
-
Target
55487eb6fbadb3219f43c53fc13b823f0574df2c50c5db7b1836bbe4160bff4e
-
Size
5KB
-
MD5
d3e502a774b789443939e8e097a1d518
-
SHA1
ca6b8e034fe529616f227ee932a567e0d1b467ba
-
SHA256
55487eb6fbadb3219f43c53fc13b823f0574df2c50c5db7b1836bbe4160bff4e
-
SHA512
e5d9022573cea5a8cf2ed72ff5267f7c35c6ddb7771746d123d5aede37daa5808f27a23dc8f14491837fdf8a6f7e90e94800fe04a36cf555527a6d305e87a8fd
-
SSDEEP
96:sosZ79Y63L1bhycf6mAa3aDFUUqIS8t1NtUqMSSavvqd3ojWrl:Kp9Y63L1bhycTWuUqIl3NtUqMSxqdr
Score10/10-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-