General
-
Target
2vsxiTQ4.exe
-
Size
45KB
-
Sample
230328-zsqgnadc83
-
MD5
3b7f9dcb3b83acf40f32d5f7c500fefb
-
SHA1
08195d91e8e187c4edfb03e3fa6784524481802a
-
SHA256
0c6b9d6c37b17c04112ce5b33b8b7770c483cb70b1e28f66d06d1bbf8384c777
-
SHA512
daa05b7159d649dcb9e7c07c010b777daee79df18c0fb0d60364e942282dc1f1d63b9c0b1929f8217000e63c3526b7464133c08e42e21be392337e4c3724fad1
-
SSDEEP
768:vuK49TH4EjZWUR+ejmo2qrL/ot3APIPzjbogX3a7bsaN3KnVABDZXx:vuK49THf520s3lP3b/XKUaN3CWdXx
Behavioral task
behavioral1
Sample
2vsxiTQ4.exe
Resource
win7-20230220-en
Malware Config
Extracted
asyncrat
0.5.7B
Christ2
dlusercontent.net:4444
3048tui grwj0grw08
-
delay
3
-
install
true
-
install_file
windllx.exe
-
install_folder
%AppData%
Targets
-
-
Target
2vsxiTQ4.exe
-
Size
45KB
-
MD5
3b7f9dcb3b83acf40f32d5f7c500fefb
-
SHA1
08195d91e8e187c4edfb03e3fa6784524481802a
-
SHA256
0c6b9d6c37b17c04112ce5b33b8b7770c483cb70b1e28f66d06d1bbf8384c777
-
SHA512
daa05b7159d649dcb9e7c07c010b777daee79df18c0fb0d60364e942282dc1f1d63b9c0b1929f8217000e63c3526b7464133c08e42e21be392337e4c3724fad1
-
SSDEEP
768:vuK49TH4EjZWUR+ejmo2qrL/ot3APIPzjbogX3a7bsaN3KnVABDZXx:vuK49THf520s3lP3b/XKUaN3CWdXx
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-