General
-
Target
csrss.exe
-
Size
48KB
-
Sample
230314-q534vaff29
-
MD5
36a18884c8e35fea7c2cf939e35bb56c
-
SHA1
f212f55722ef7e4382bd5c59746ff60e26142c47
-
SHA256
c1ad03476f5a2fe877b28c242eb68db4b0362e75dba1b595d458fce209dd5f28
-
SHA512
47c2c5c36a0d8cba84af5834b839c96a1e742cd9e0d98772f03b37e02f665996b3f7949e49ed513213350cc5996b1ad10d0a8dc05d5bb9a4fe6ed98a057a22f6
-
SSDEEP
768:0ujYC71TBEwp/WUTQy9mo2qzqSmHGHwVdgPIazQaWozr0bJLlDc76GoQjHb72cso:0u8A1TBvD2bSmF3FaMaBgbJLF3No6ti1
Behavioral task
behavioral1
Sample
csrss.exe
Resource
win7-20230220-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
csrss.exe
-
install_folder
%Temp%
-
pastebin_config
https://pastebin.com/raw/3Z9zi18j
Targets
-
-
Target
csrss.exe
-
Size
48KB
-
MD5
36a18884c8e35fea7c2cf939e35bb56c
-
SHA1
f212f55722ef7e4382bd5c59746ff60e26142c47
-
SHA256
c1ad03476f5a2fe877b28c242eb68db4b0362e75dba1b595d458fce209dd5f28
-
SHA512
47c2c5c36a0d8cba84af5834b839c96a1e742cd9e0d98772f03b37e02f665996b3f7949e49ed513213350cc5996b1ad10d0a8dc05d5bb9a4fe6ed98a057a22f6
-
SSDEEP
768:0ujYC71TBEwp/WUTQy9mo2qzqSmHGHwVdgPIazQaWozr0bJLlDc76GoQjHb72cso:0u8A1TBvD2bSmF3FaMaBgbJLF3No6ti1
-
Async RAT payload
-
Legitimate hosting services abused for malware hosting/C2
-