General
-
Target
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
-
Size
63KB
-
Sample
230131-n9krysgb96
-
MD5
06222dcad1b558484a8a4e74ff423528
-
SHA1
c67dfbea59c50baaffd262b508fea061f827700e
-
SHA256
5177f4016e4e616d5dd750c1b84f7021fd2802aefc9cce55ae0c2691c2052ab6
-
SHA512
adbfa6aaf369feef9a8ec4bb4b4ee643a432c1f4c5438fcc5060517045fa0c58883f226f56bc77e7a05b2fb01ca7470fb173f64ff00cbdb8db6303246441b960
-
SSDEEP
1536:oThA4fjgyCZ78D+iCTuo8hM5zPAB4zOCW3YDz3Akg:o99rgRZn8WFPAB4qCAYfAkg
Static task
static1
Behavioral task
behavioral1
Sample
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Targets
-
-
Target
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
-
Size
87KB
-
MD5
ca699117112a173ca7b289f1baf6c3c0
-
SHA1
862f227d4fa0b4de892006d7fe19e610e9f1a676
-
SHA256
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
-
SHA512
d9f82f6e18ce2eb624a5ee1e20618318fde7ffdcff834d9c0291f4971bd72ce9b7f5108bf45f11ceed4d1f526bad4842913e833a25e3d99a3235d6f87b4d2620
-
SSDEEP
1536:sUZggDGVM9WSZvZHU+uyWrHyHndw/VTtvVCMI4bgAQ9uaJZA2DJpO:sUigDGVMU4vZUZJmHdeVTtI4bgAQ9uaE
Score10/10-
Async RAT payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-