General
-
Target
b71e17188f06c9265fc525bb8e52b284a831c53d7b1811a18b85999363550112
-
Size
5KB
-
Sample
230121-hg8enacf3t
-
MD5
6183087e8bcfe6053bf0883599a78e14
-
SHA1
7cf0cfbf5bf20540db602b27c3f3917647aba56b
-
SHA256
b71e17188f06c9265fc525bb8e52b284a831c53d7b1811a18b85999363550112
-
SHA512
a13d7d1b02c72c0ba6ffa4e012bf606fc49fe33e1b9a594a2a7d2108748310feb4426b3d4e6932a99e3ca3473ee7ffc97b880a1c56034e651b96d2e21fb270d7
-
SSDEEP
96:iu796OCFsS9O6Cotjhsvk+FBAYUs8vk+FCcUvfd3oj+rl:iY96dFjqoPsvkxYUvkh/fd9
Static task
static1
Behavioral task
behavioral1
Sample
b71e17188f06c9265fc525bb8e52b284a831c53d7b1811a18b85999363550112.exe
Resource
win10-20220812-en
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Targets
-
-
Target
b71e17188f06c9265fc525bb8e52b284a831c53d7b1811a18b85999363550112
-
Size
5KB
-
MD5
6183087e8bcfe6053bf0883599a78e14
-
SHA1
7cf0cfbf5bf20540db602b27c3f3917647aba56b
-
SHA256
b71e17188f06c9265fc525bb8e52b284a831c53d7b1811a18b85999363550112
-
SHA512
a13d7d1b02c72c0ba6ffa4e012bf606fc49fe33e1b9a594a2a7d2108748310feb4426b3d4e6932a99e3ca3473ee7ffc97b880a1c56034e651b96d2e21fb270d7
-
SSDEEP
96:iu796OCFsS9O6Cotjhsvk+FBAYUs8vk+FCcUvfd3oj+rl:iY96dFjqoPsvkxYUvkh/fd9
Score10/10-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-