General
-
Target
07f9be474506e26391df8b201f0eab566181a9728df18df85cb3f831539023d6
-
Size
5KB
-
Sample
230119-hw34gsfc69
-
MD5
6af6153204c4deead636e405c38e2747
-
SHA1
5d0eaa80f2b6aa6c009f11692c9c3aeae91ac7bc
-
SHA256
07f9be474506e26391df8b201f0eab566181a9728df18df85cb3f831539023d6
-
SHA512
4894e88d9b5ccb6b3371afbf65288e76120144d81ca32d9d19596cd71801e7f78b0c193e7004bc7f8346951f6115d761038448c654a6923263c5e3cf6d83c0cf
-
SSDEEP
96:P79cV3CFs61U7B0twmvk+ZpAYbPsDvk+ZqMntvngd3ojVirl:z9cVyFRU7B01vklYSvklygdoq
Static task
static1
Behavioral task
behavioral1
Sample
07f9be474506e26391df8b201f0eab566181a9728df18df85cb3f831539023d6.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Targets
-
-
Target
07f9be474506e26391df8b201f0eab566181a9728df18df85cb3f831539023d6
-
Size
5KB
-
MD5
6af6153204c4deead636e405c38e2747
-
SHA1
5d0eaa80f2b6aa6c009f11692c9c3aeae91ac7bc
-
SHA256
07f9be474506e26391df8b201f0eab566181a9728df18df85cb3f831539023d6
-
SHA512
4894e88d9b5ccb6b3371afbf65288e76120144d81ca32d9d19596cd71801e7f78b0c193e7004bc7f8346951f6115d761038448c654a6923263c5e3cf6d83c0cf
-
SSDEEP
96:P79cV3CFs61U7B0twmvk+ZpAYbPsDvk+ZqMntvngd3ojVirl:z9cVyFRU7B01vklYSvklygdoq
Score10/10-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-