General
-
Target
5a9436052ba16ec5387d5d029eac2adec32e21747e35ec4774aefc5cd566b06d
-
Size
5KB
-
Sample
230317-hqjgwsef67
-
MD5
865f56a97781bcde44902cfe823d2f92
-
SHA1
0a2b52cbdd7c37bdce9ed9cad5dc6c7c2c8ed0bf
-
SHA256
5a9436052ba16ec5387d5d029eac2adec32e21747e35ec4774aefc5cd566b06d
-
SHA512
b2e56a320cae58c2b196be7043152131c2af89db71b0ea8038b84ba622ad79f7ba5202855b5998d9781935102aeb053664b6462bbe153424d22226882147a96b
-
SSDEEP
96:Ps793KCFQyIeNWL4xG8Fq/5yZZUvfd3oj7rl:S93RFjNWLsG8Fq/5yZefde
Static task
static1
Behavioral task
behavioral1
Sample
5a9436052ba16ec5387d5d029eac2adec32e21747e35ec4774aefc5cd566b06d.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Targets
-
-
Target
5a9436052ba16ec5387d5d029eac2adec32e21747e35ec4774aefc5cd566b06d
-
Size
5KB
-
MD5
865f56a97781bcde44902cfe823d2f92
-
SHA1
0a2b52cbdd7c37bdce9ed9cad5dc6c7c2c8ed0bf
-
SHA256
5a9436052ba16ec5387d5d029eac2adec32e21747e35ec4774aefc5cd566b06d
-
SHA512
b2e56a320cae58c2b196be7043152131c2af89db71b0ea8038b84ba622ad79f7ba5202855b5998d9781935102aeb053664b6462bbe153424d22226882147a96b
-
SSDEEP
96:Ps793KCFQyIeNWL4xG8Fq/5yZZUvfd3oj7rl:S93RFjNWLsG8Fq/5yZefde
Score10/10-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-