General
-
Target
46c6ffe88a3541f179da56eac0d6649fe5b20b561a43793bb7b5c1b8282ad4df
-
Size
5KB
-
Sample
230131-j3d9dahc6x
-
MD5
d7f8019fa6a535bc1b0b7f9fc1f751ae
-
SHA1
f496986f7a40c0a9ef35c950f48522faf7d403d9
-
SHA256
46c6ffe88a3541f179da56eac0d6649fe5b20b561a43793bb7b5c1b8282ad4df
-
SHA512
aa76eb6b09fe7fa2b1a2008ca2d1bebb76cb628b786635b21fad0f44a5c895f6089a790e11dd620bb741c6cca223511cd18e971a68a3e3b223b5cfabbd9fea65
-
SSDEEP
96:cHkI5797fCFVwiTVtowwvk+dw78bC/+PGc7Y3d3ojVrl:WJ976FPVnwvka+8bC/+Pg3ds
Static task
static1
Behavioral task
behavioral1
Sample
46c6ffe88a3541f179da56eac0d6649fe5b20b561a43793bb7b5c1b8282ad4df.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Targets
-
-
Target
46c6ffe88a3541f179da56eac0d6649fe5b20b561a43793bb7b5c1b8282ad4df
-
Size
5KB
-
MD5
d7f8019fa6a535bc1b0b7f9fc1f751ae
-
SHA1
f496986f7a40c0a9ef35c950f48522faf7d403d9
-
SHA256
46c6ffe88a3541f179da56eac0d6649fe5b20b561a43793bb7b5c1b8282ad4df
-
SHA512
aa76eb6b09fe7fa2b1a2008ca2d1bebb76cb628b786635b21fad0f44a5c895f6089a790e11dd620bb741c6cca223511cd18e971a68a3e3b223b5cfabbd9fea65
-
SSDEEP
96:cHkI5797fCFVwiTVtowwvk+dw78bC/+PGc7Y3d3ojVrl:WJ976FPVnwvka+8bC/+Pg3ds
Score10/10-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-